Report suspected vulnerabilities using the affected repository's GitHub Report a vulnerability action. Include the affected version, a minimal reproduction, and the impact. Do not include passwords, API secrets, session keys, or private media libraries in a report.

The current stable release of each active project receives security fixes. Jellyfin 12 is the supported host line for JellySin plugins. Fixes receive new versions; published artifact bytes and Plugin Repository history remain immutable.

Maintainers give a first answer within 14 days of a report. A fix has no promised date; how long it takes depends on the case.

Please allow maintainers to assess and fix an unpatched vulnerability before publishing exploit details. Ordinary bugs and feature requests belong in issues.