Codescribe supports the newest published release only. Security fixes land in source first and reach users in the next published release, which installed copies receive through the in-app updater.

If you discover a security issue, please do not open a public issue.

Use one of these private channels:

• Email: security@vetcoders.io
• Fallback: hello@vetcoders.io

Please include:

• Affected version
• Reproduction steps
• Impact assessment
• Any suggested mitigation

• Initial acknowledgment: within 2 business days
• Triage decision: within 5 business days
• Fix timeline: shared after triage
• Public disclosure: after mitigation is available

1. We acknowledge and triage the report.
2. We reproduce and classify severity.
3. We implement and validate a fix.
4. We publish release notes and attribution (if requested).

For local-first workflows, this project handles:

• Microphone/audio capture
• Local model execution
• Optional API traffic to configured LLM providers
• The license-key service at https://codescribe.vetcoders.io/api/license/issue
• The signed Sparkle update feed at https://codescribe.vetcoders.io/appcast.xml

Please include provider and endpoint details in your report when relevant.