Security fixes are applied to the current main branch and the latest stable release of Immich Desktop. Older releases are generally not patched separately; please upgrade when a fixed release is available.

Please do not open a public GitHub issue for security vulnerabilities.

Prefer one of these private channels:

1. GitHub Security Advisories - Report a vulnerability
2. Contact the maintainer privately: @hdmain

Include as much detail as you can:

• Affected version or commit
• Impact (e.g. credential leak, unexpected network behavior, local file access)
• Steps to reproduce or a proof of concept
• Whether you plan to disclose publicly and on what timeline

• We aim to acknowledge reports within a few days.
• We will discuss severity, a fix plan, and coordinated disclosure when appropriate.
• Credit is welcome unless you ask to remain anonymous.

Immich Desktop talks to your Immich server and related URLs you configure. Reports about the official Immich server itself should go to the Immich project, not this repo. Client bugs that mishandle credentials, certificates, custom headers, or local caches in this app are in scope here.