Please do not open a public issue for security problems. Report them privately with GitHub private vulnerability reporting on this repository. Include steps to reproduce and the affected version.

We aim to acknowledge reports within 3 business days and to publish a fix and advisory once a patch is available.

Security fixes are released for the latest minor version of each Patchkite package.

How Patchkite protects updates — code signing, hash verification, and the risks we accept — is described in the security model.