Tri-State Relay Service does not yet have multiple supported release lines. Use the latest public source or latest signed direct-download release when releases are available.
Do not report vulnerabilities in public issues if the report includes secrets, private notification content, relay queue contents, logs with credentials, personal transcripts, signing material, or exploit details that would put users at risk.
Preferred private path: use GitHub private vulnerability reporting for this repository.
If private vulnerability reporting is unavailable, wait for a maintainer-provided disclosure path before sharing sensitive details publicly.
Security-sensitive areas include:
- Any path that could cause the CLI to speak directly.
- App-owned playback claim and queue state transitions.
- Ready, Focus, and Mute behavior.
- Message validation and unsafe content rejection.
- SQLite queue persistence and local data exposure.
- App startup, Open at Login, permissions, signing, notarization, and release packaging.
- External command configuration for inactive-line combination.
When reporting non-sensitive bugs publicly, sanitize logs and examples. Do not include real relay messages, private notification text, queue database files, tokens, customer content, or full terminal output.