Kando is a volunteer-run open source project. We maintain security updates for the latest major release only.

If you are using an older version, please upgrade to the latest release.

If you believe you have found a security vulnerability in Kando or one of its dependencies:

1. Do not open a public issue.
2. Instead, use GitHub’s private vulnerability reporting.

We aim to acknowledge all reports within 7 days and provide a status update within 14 days.

Kando does not run privileged code or access sensitive user data. Still, users should:

• Avoid downloading releases from untrusted sources.
• Keep Kando and its dependencies up to date.
• Verify checksums or signatures (if provided).

Thank you for helping keep Kando and the open-source community safe!