Redactyl is alpha software. Security fixes are applied to the latest commit on main; there are no supported release branches yet.

Use GitHub's private vulnerability-reporting form under the repository's Security tab. Include the affected commit, impact, reproduction steps and a synthetic test document where one is needed.

Do not put vulnerabilities, credentials, personal information or real sensitive documents in a public issue. If private reporting is unavailable, open a public issue asking the maintainer to enable a private channel, without including security details.

Redactyl processes documents locally. Reports can contain detected values and local paths, so remove sensitive content before attaching logs. A successful verification does not prove that a document is safe to share.