Report it privately through GitHub's private vulnerability reporting, not in a public issue. Describe the impact, the commit or version you found it in, and include the smallest reproduction you have. Remove secrets, tokens, and personal data from anything you paste.

A vulnerability in a dependency that Haku uses, such as Tauri or WebView2, goes to that dependency's maintainers. If you are not sure which side it is on, report it here.

A way to make Haku break a guarantee its documentation makes is a vulnerability. Haku loads arbitrary remote pages, so the boundary between a page and the application is what matters most: a way for a page to reach the interface, call a command, read another tab's state, or present its content as Haku's own is in scope. Architecture § Security describes what that boundary is meant to guarantee.

Haku has no releases yet. Fixes land on main.