The latest published release is the supported version. The application is a local browser editor; it does not request service credentials or send your manuscript to an application server.

For a vulnerability, use the repository's Security → Report a vulnerability feature when available. If that private channel is unavailable, open an issue with only the affected version and a high-level description and request a private contact method. Do not publish exploit payloads containing private text, tokens, personal paths, or storage exports.

Report ordinary input or layout bugs with synthetic reproductions. Check release SHA-256 checksums before using a downloaded package. Code changes that introduce network access, remote dependencies, import parsing, or storage-format changes need explicit review and corresponding tests.