Do not open a public issue. Report privately through GitHub Security Advisories, or e-mail contact@ludo-tech.org.

Include the Hiroba version, whether the issue affects the client, the server, or the hosted edition at hirobaoffice.com, and steps to reproduce.

You will get an acknowledgement within 3 business days. Fixes ship as a new release and are credited in the advisory unless you prefer otherwise.

Only the latest release is supported. Hiroba updates itself in place, so staying current requires no action.