Only the latest main branch is actively supported. Tagged releases receive patches at the maintainer's discretion.

Please do not open a public issue for security-sensitive reports.

Instead, use one of:

1. GitHub Security Advisories — open a private advisory. Preferred.
2. Email — dipesh.nx@gmail.com. Use subject line [teleprompter security].

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix, if any

You can expect an initial response within 7 days. Fixes for confirmed vulnerabilities will be prioritized over other work.

Since teleprompter runs locally on a user's Mac and does not accept network input, the attack surface is small. Reports of particular interest:

• Local privilege escalation
• Path traversal through script IDs or imported file paths
• Screen-capture leakage (teleprompter content visible to attendees via Zoom share when hiding should apply)
• Arbitrary code execution via imported .txt / .md files

Out of scope: issues in upstream dependencies (Tauri, Svelte, Rust crates) — please report those to the respective projects.