(This table is updated with each release; older tags stop receiving fixes when a new minor ships.)

Please do not open a public issue for security vulnerabilities.

Use one of these private channels instead:

1. GitHub private vulnerability reporting — open the repository's Advisories page (Security → Advisories) and select Report a vulnerability. This is the preferred channel.
2. If private reporting is unavailable, contact the maintainers through a private channel listed on their GitHub profiles.

• Affected version or commit
• A minimal reproduction (steps or a small PoC)
• Impact assessment (confidentiality / integrity / availability)

• Captured secrets, tokens, or credentials
• Full terminal dumps that may contain private local data
• Unredacted user paths or environment variables that expose secrets

We aim to acknowledge valid reports promptly and coordinate a fix before any public disclosure. Please give maintainers a reasonable window to investigate and release a fix before publishing details.

MemoryWhale stores sensitive development evidence on the local machine. For how local data is protected (threat model, not vulnerability reporting), see docs/SECURITY.md.