Kettu runs coding agents that run shell commands, so a security problem can be serious. Report it privately through GitHub's private vulnerability reporting, never in a public issue, pull request or discussion.

Only the latest release gets security fixes.

We read every report and reply on it. A confirmed vulnerability is fixed in a new release, which we publish with an advisory.