Only the latest release receives security fixes. If you are on an older version, update first — the desktop app can do that from the app menu.

Please do not open a public issue for a security problem.

Report it privately through GitHub's advisory form:

https://github.com/phaethix/mind-map/security/advisories/new

Include what you can:

• the affected version and platform;
• steps to reproduce, or a proof of concept;
• the impact you believe it has.

• An acknowledgement within 7 days.
• An assessment, and when a fix is needed, a patch in the next release.
• Credit in the release notes, unless you prefer to stay anonymous.

In scope: the desktop shell (Tauri commands, updater, local file handling), the web app, and the build scripts.

Out of scope: vulnerabilities in third-party dependencies. Report those upstream; the fixed version is picked up as soon as it is released.