RenUI is pre-1.0 software. Security fixes are applied to the latest published release and the main branch; older 0.x releases may not receive patches.

Please do not disclose a suspected vulnerability in a public issue, discussion, or pull request. Use GitHub's private vulnerability reporting and include:

• the affected version or commit;
• the environment and build configuration;
• reproduction steps or a minimal proof of concept;
• the expected impact and any known mitigations; and
• whether the report may be credited publicly.

The maintainer will acknowledge the report, investigate it, and coordinate a fix and disclosure when warranted. Please allow time for a patch to be prepared before publishing technical details.

For ordinary bugs without a security impact, use the public issue forms.