Taskstitch is pre-1.0. Security fixes target the latest release and the current main branch; older snapshots may not receive fixes.

Do not report a vulnerability through a public issue, pull request, or discussion. Use GitHub's private vulnerability reporting instead.

Include only the information needed to investigate:

• the affected Taskstitch version or commit;
• operating system and Python version;
• the potential impact;
• minimal reproducible steps or a proof of concept; and
• a suggested mitigation, if known.

Redact credentials, tokens, personal information, private source code, and real Taskstitch databases or logs. Never submit live secrets, even in a private report.

Reports will be acknowledged as soon as practical. Please allow time for investigation and coordinated disclosure before publishing exploit details. Taskstitch does not currently operate a bug-bounty program.