Push is early software. Security fixes are made on the latest release and the main branch. Older releases may not receive fixes.

Do not open a public issue or pull request for a suspected vulnerability.

Use GitHub private vulnerability reporting to share the problem, its impact, and steps to reproduce it. Remove secrets, tokens, personal messages, and other private data from the report.

The maintainer aims to reply within seven days. Please allow time to investigate and prepare a fix before sharing the issue in public.

For advice on running Push safely, read the permissions and security guide.