Please don't report security issues through public GitHub issues, Discord, the forums, or the general support address.

Report them privately using GitHub's private vulnerability reporting on this repository. It's enabled, it goes straight to the maintainers, and nothing is public until we publish an advisory.

Please include:

• What the issue is and roughly how severe you think it is
• The Vortex version and operating system you saw it on
• Steps to reproduce it, and a proof of concept if you have one
• Anything you think we should know about disclosure timing

We'll get back to you as soon as we can and keep you updated as we work on it. If the issue is confirmed we'll credit you in the release notes unless you'd rather we didn't.

Security fixes go into the current stable release of Vortex. We don't backport them to older versions.