If you find a security issue in kei, please report it through GitHub's private security advisory. This keeps the details private until a fix is ready.

If you can't use GitHub advisories, email github@robhooper.xyz with "kei security" in the subject.

• Credential leakage (passwords, session tokens, cookies exposed in logs, temp files, or error output)
• Authentication bypass or session hijacking
• Path traversal or arbitrary file writes outside the download directory

General bugs (crashes, incorrect downloads, UI issues) are fine as regular GitHub issues.

kei is a solo-maintained project. I'll acknowledge reports within a few days and aim to ship fixes promptly, but there's no SLA. I won't publicly disclose details until a fix is released.

CI runs cargo audit on every pull request to catch known vulnerabilities in dependencies.