Please do not report security vulnerabilities in public issues, discussions, or pull requests. Use GitHub's Report a vulnerability feature in the repository's Security tab when it is available. If private vulnerability reporting is unavailable, contact the maintainer privately through GitHub and ask for a secure reporting channel; do not include exploit details in a public post.

Include the affected version or commit, the impact, steps to reproduce, and any suggested mitigation. Avoid accessing or changing data that is not yours, and do not test against other people's devices or accounts.

The maintainer will review reports and coordinate a fix and disclosure with the reporter. Good Signal does not currently offer a security bounty.

Only the latest version on the default branch is supported. Good Signal is a static web app and does not currently publish numbered software releases.