Fixes are developed on the active branch and included in the next release. Upgrade to the latest release; older versions do not receive backports.

Email report.toucan@rasyid.dev with the subject Toucan security report. Do not disclose vulnerabilities in public issues or pull requests.

Include the affected version, operating system, reproduction steps, potential impact and a minimal example if available. Remove credentials and private translation data.

We aim to acknowledge reports within 7 days and provide an update at least every 14 days while investigating. These are targets, not guaranteed response times.

If accepted, we will coordinate a fix and disclosure with you and offer credit with your permission. If declined, we will explain why. Please keep details private until a fix or disclosure date is agreed.