Only the latest published DM2Text release receives security updates during the MVP phase.

Use GitHub Private Vulnerability Reporting. Do not open a public issue for a suspected vulnerability.

Describe the impact and provide the smallest reproducible steps. Never include real Instagram messages, usernames, thread IDs, cookies, session material, credentials, or unredacted DOM captures. Use synthetic or fully anonymized evidence.

The maintainer will acknowledge a report when practical, investigate it privately, and coordinate disclosure after a fix is available. No resolution timeline is guaranteed.