Clix is experimental software with no stable release or supported maintenance branches yet. Include the exact commit or binary hash in a report. The current authority model and unproved claims are recorded in current work and the README.

Use Report a vulnerability on the repository's Security advisories page when private reporting is enabled. If that option is unavailable, open an issue asking for a private contact, without including vulnerability details. Do not post an exploit, credentials, owner keys, pairing phrases or private device information in a public issue.

Include the affected revision, operating systems, the authority or data at risk, and a minimal reproduction using disposable state and synthetic identities. Distinguish an observed failure from a suspected one. There is no promised response time at this stage.