Security fixes are made against the latest released version of oxdg. Older releases may not receive backports.

Please do not open a public issue for a security vulnerability.

Use GitHub's private vulnerability reporting for this repository when it is available:

https://github.com/halqme/oxdg/security/advisories/new

Include enough information to reproduce and assess the issue:

• affected oxdg version or commit;
• affected command or API;
• operating system and runtime version;
• a minimal reproduction;
• expected and observed behavior;
• impact and any known exploitation conditions.

If private vulnerability reporting is unavailable, open a public issue without vulnerability details asking the maintainer for a private contact channel.

Please allow reasonable time for investigation and a fix before public disclosure.

Reports are especially useful for issues involving arbitrary code execution, command or argument injection, unsafe file access, malicious project input, dependency resolution that escapes intended boundaries, or vulnerabilities in published package/release infrastructure.

Ordinary bugs and feature requests should use the normal issue templates.