Please report security problems privately through GitHub: Security → Report a vulnerability on https://github.com/MKBSP/capfolder (or https://github.com/MKBSP/capfolder/security/advisories/new). Don't open a public issue.

In scope: the desktop app (apps/desktop), the engine (packages/core), the signing relay (apps/relay) and the release/update pipeline (.github/workflows, the update and rules-pack signatures). We reply within a few days. Please don't test against other people's data or a relay you don't run.