Use the latest published release. Security fixes are developed on master and delivered in new releases.

Do not disclose vulnerabilities, credentials, private repository contents, or working exploits in a public issue.

Use GitHub's Report a vulnerability action on the repository's Security page. If that action is unavailable, contact a repository maintainer through a private channel listed on their GitHub profile and ask them to open a draft security advisory for follow-up.

Include the affected version or commit, impact, reproduction steps, and any suggested mitigation. Remove credentials and unrelated personal data from logs.

Security-sensitive areas include permission decisions, command presentation, workspace path confinement, Muse process invocation, and Zed settings edits.