If you have found a bug that affects the security of your system, please report it privately instead of opening a public issue.

Only the most recent release and master are supported.

• An app can execute a command when run outside of a sandbox
• An app can write / read the compositor's sockets when run outside of a sandbox
• Crashes
• Things that are protected via permissions when the permission system is disabled

• A sandboxed application executing arbitrary code via Hypoland
• An application being able to modify Hypoland's code on the fly
• An application being able to keylog / track the user's activity beyond what the Wayland protocols allow

Use Report a vulnerability on GitHub.

Most of Hypoland's code comes from Hyprland. If the issue is in code that Hypoland shares with Hyprland, it probably affects Hyprland too: please also report it to Hyprland, following their security policy.