Report vulnerabilities privately through GitHub security advisories. Include the affected version, a synthetic reproduction, and the expected impact. Please avoid including real Matrix messages, access tokens, user identifiers, or homeserver details.

Security fixes target the latest published version. Upgrade before reporting an issue already fixed in a newer release.

The Element module renders messages only from configured senders. Keep that allow-list narrow. Custom namespaces are routing keys, not an authentication mechanism. The math CLI requires a trusted resvg executable and fonts; the Nix package pins both and applies a process timeout.