Security fixes are applied to the latest release of Croc GUI on GitHub Releases and the main branch when practical.

Please do not open a public issue for security problems.

1. Prefer a private GitHub Security Advisory on interfluve-wav/croc-gui if available.
2. Otherwise contact the maintainer via interfluve-wav.

Include: affected OS/version, steps to reproduce, impact, and whether the issue is in the GUI wrapper or likely in upstream croc.

Vulnerabilities in the croc protocol, crypto, or CLI should also be reported to schollz/croc following their process. This GUI bundles their binary; we will coordinate when both projects are affected.

• This app invokes a bundled croc binary and streams its output.
• Do not include secrets, private keys, or production credentials in reports or screenshots.