Until the first public beta tag, only the latest commit on main is considered for security fixes. Supported release ranges will be listed here after tagged releases exist.

Do not open a public issue with vulnerability details, credentials, private project URLs or user-authored Ren'Py content.

Use GitHub's private vulnerability report for this repository:

https://github.com/the-asind/RenPy-VisualEditor/security/advisories/new

If private vulnerability reporting is unavailable, contact the maintainer through the GitHub profile and ask for a private channel without including exploit details in the first public message.

Include the affected version or commit, impact, reproduction conditions and a minimal sanitized proof when possible. You should receive an acknowledgement within seven days during the public beta.