Security fixes currently target the latest source on main and the latest GitHub release. npm packages are not published.

Use GitHub's private vulnerability reporting for this repository. Do not open a public issue for an unpatched vulnerability and do not include credentials, private data, or active exploit details in public discussions.

Include the affected component and version or commit, reproduction details, impact, and any suggested mitigation. Reports will be acknowledged and assessed as project capacity allows; no response or remediation SLA is promised.

Reports about Recode source and release artifacts are in scope. Provider services, model hosts, Telegram, terminals, operating systems, third-party extensions, and other external integrations should also be reported to their respective owners when the defect is outside Recode.

Never send real secrets. Revoke any credential that may have been exposed.