Security fixes target the latest available RustShot 1.x release. Development snapshots receive best-effort fixes but are not supported release artifacts.

Vulnerabilities are reported through GitHub's private security advisory form, not a public issue. Reports are most useful when they include the affected version, impact, reproduction steps, and the smallest safe proof of concept.

Complete reports are acknowledged and assessed privately. An advisory is published when user action is required, with reasonable time allowed for a coordinated fix before disclosure.

Security-sensitive components include screen capture, clipboard ownership, secure redaction, image encoding, configuration paths, global shortcuts, native Windows handles, release artifacts, and the dependency supply chain.

The project uses locked dependencies, RustSec advisory checks, source and license restrictions, warnings for application-level unsafe code, and isolated Windows FFI modules. Automated checks support the native-code review boundary but do not replace it.

RUSTSEC-2026-0192 marks the transitive ttf-parser 0.25.1 dependency as unmaintained. The dependency is reached through fontdue 0.9.4, has no reported vulnerability or safe upgrade, and is explicitly documented in deny.toml. The exception is limited to this maintenance advisory.