Report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue, pull request, or Discord thread about a vulnerability.

Include the Aurral version, how you run it, and the steps that reproduce the problem. We reply in the advisory.

Fixes go to nightly first and ship in the next stable release. Older releases do not get fixes, so update to the latest stable release.