Please do not open a public issue for a security problem.

Report it privately through GitHub instead: Report a vulnerability (the Security tab of this repository ▸ Report a vulnerability).

Include:

• what an attacker could do, and under which conditions;
• the steps to reproduce it, with the Leafrune version (Help ▸ About Leafrune) and your Windows version;
• if a PDF is needed to show it, a minimal file you made yourself. Never send confidential documents.

You will get a reply within 7 days. Once the problem is confirmed, a fix is prepared and released before the details are made public, and you are credited in the release notes unless you prefer otherwise.

Leafrune is in beta. Security fixes go into the latest release only; please update before reporting.

Examples of problems we want to hear about:

• a PDF that makes Leafrune run code, read or write files it should not, or open web pages without the user clicking a link;
• anything that sends document contents, questions or answers off the computer;
• a way to make the model download fetch or run files other than the published ones.

Wrong or odd assistant answers are not security problems; report them with the Wrong answer issue form.