Report a vulnerability privately through GitHub's Report a vulnerability form. It opens an advisory visible only to you and the maintainers. Do not open a public issue, and do not email the maintainer: a public issue describing a live path into a laptop is a disclosure, not a report. Include the version or commit, the deployment (self-hosted Relay, Hosted, standalone app, VS Code extension), and the shortest reproduction. Every advisory is acknowledged with what we intend to do about it; there is no bounty.

What Dormouse guarantees, what it does not, and how that is checked is the security spec, docs/specs/security.md, published at dormouse.sh/security — whole, with the guarantees gathered there from beside the checks that hold them, and that table and the two lists narrowed to the page's audience. Its Domains table names every audited checklist beside it, whose FAIL IF lines a nightly audit executes and every VS Code release is gated on. Every run's verdicts and counts are public in the pinned Security audit status issue; a finding's details stay private until it is fixed or for 7 days, then are published under security-audit-finding.