Security fixes are applied to the current main branch and the latest tagged release.

Please report security issues privately through GitHub Security Advisories.

Include:

• A description of the issue and its impact
• Reproduction steps or a proof of concept
• Affected browsers or environments
• Any suggested mitigation

Do not open a public issue for an unpatched vulnerability. You can expect an initial response within seven days. Please allow time for a fix and coordinated disclosure before publishing details.

Aetheria runs artwork generation, local saves, and PNG exports in the browser. Reports involving script execution, unsafe URL parsing, service-worker cache poisoning, dependency compromise, or unintended data transmission are in scope.

Availability issues in third-party hosting or browser implementations should be reported to the relevant provider unless Aetheria causes or amplifies the issue.