The currently maintained release is 0.21.0. Releases are unsigned; verify the published SHA-256 checksums.

Use GitHub private vulnerability reporting. Include the affected version, a minimal reproduction, impact and sanitized evidence. Do not post credentials, customer data, private target reports or live session tokens publicly.

Reports about third-party websites belong to the target owner's authorized disclosure process. OBSIDIAN's responsible-use notice does not grant target authorization.

See the Security Model for limits and evidence handling. A completed scan or zero findings is not proof of security.