Please report vulnerabilities privately through GitHub's "Report a vulnerability" button on the Security tab of FormaIDE, or by email to grangedevgroup@gmail.com. Don't open a public issue for them.

Include what you found, how to reproduce it, and which version or commit you tested. You'll get a reply within a week.

The areas that matter most are the ones that protect people's files and credentials: the project filesystem boundary, approval of AI-proposed changes and commands, plugin permissions, and API key storage. Only the latest release gets fixes.