Security fixes are developed on main and shipped in the newest release. The current release and main receive security fixes; older releases are not guaranteed to receive backports. Upgrade to the latest release before reporting an issue that may already be fixed.

Do not disclose a suspected vulnerability in a public GitHub issue, discussion, pull request, commit, or other public channel.

Use GitHub private vulnerability reporting. Include enough information for maintainers to reproduce and assess the issue:

• The affected version, release tag, or commit.
• Deployment type, operating system, and architecture.
• Reproduction steps, impact, and required privileges or network access.
• Relevant logs or screenshots with secrets and personal data removed.
• A suggested mitigation or fix, if available.

Never submit a real CONTROL_TOKEN, CLASH_SECRET, subscription URL, profile, private key, or other credential. Replace sensitive values with clearly marked placeholders.

Maintainers will triage the report privately, may request more information, and will coordinate any fix, advisory, and release before public disclosure. Please allow time for investigation and coordinate disclosure timing with the maintainers.

Non-security bugs can be reported through the public issue tracker.