Please report vulnerabilities privately to support@kadal.cc with "Kadal Deck security" in the subject, rather than in a public issue. Include what is affected (the engine, the CLI, a renderer, the VS Code extension, or the hosted service at deck.kadal.cc), how to reproduce it, and its impact.

You'll get an acknowledgement within three working days and a plan within ten. Fixes ship as a patch release with a changelog entry crediting you, unless you'd rather not be named.

Supported versions: the latest minor release of each @kadal/* package, and the latest release of the VS Code extension.