Please report security problems privately, not in a public issue.
- Open the Security tab of this repository.
- Choose Report a vulnerability and describe what you found.
Please include the app and version, your operating system, the steps to reproduce it and what an attacker could do with it. Don't include real tokens, passwords, certificates or customer data. Describe them instead.
You'll get an answer as soon as it can be looked at, and a fix ships as a new release.
Only the newest release of each app gets security fixes. MonStack updates itself from this page, so staying current is a matter of using Settings > Updates.
Each release lists SHA256SUMS.txt, and the in-app updater only accepts releases signed with the MonStack release
key built into the app. See the README for how to check a download.