Security fixes are provided in the latest OpenTubeX release. Update to the latest release to receive them. Fixes are not backported to older releases.

Nightly builds are development previews. You can report vulnerabilities found in them, but individual nightly builds do not receive security updates.

Report suspected vulnerabilities privately through GitHub's vulnerability reporting form. Do not include vulnerability details in public issues, discussions, or pull requests before a fix is available and disclosure has been coordinated.

Include as much of the following as possible:

• The affected OpenTubeX version or nightly commit, operating system, and installation source.
• A description of the vulnerability and its potential impact.
• Steps to reproduce it, including a minimal proof of concept if available.
• Any relevant logs or screenshots, with credentials and personal data removed.

Maintainers will review the report and may ask for more information in the private GitHub advisory. There is no guaranteed response or resolution time; updates will be shared there as the investigation progresses.

If the vulnerability is confirmed, maintainers will coordinate a fix and public disclosure with you through the advisory. If the report is declined, maintainers will explain why in the private report.

For bugs without a security impact, use the public issue tracker.