The latest 0.x release receives security fixes. See browser and runtime support for requirements.

Do not open a public issue. Use GitHub's private vulnerability report to share reproduction steps, affected versions, impact, and any suggested mitigation. This creates a private discussion with the maintainers and supports coordinated disclosure and credit.

Never include real provider keys, issued credentials, microphone recordings, or user transcripts. Use redacted values or a minimal test account.

The maintainers will acknowledge the report, investigate it, and coordinate a fix and disclosure timeline through the private advisory. Please avoid public disclosure until a fix is available or a disclosure date has been agreed.