Report vulnerabilities privately through GitHub's security advisory feature or to feedback@chromatic.hu. Include the version, reproduction steps and relevant errors. Remove private keys, passphrases and personal host details from logs before sharing them.

Connecty rejects unknown, changed and revoked SSH host keys. It does not provide an option to silently bypass host verification. Connection credentials remain on the user's PC; there is no hosted Connecty account or telemetry service.