Please report undisclosed vulnerabilities privately through GitHub Private Vulnerability Reporting. The repository owner enabled and verified this private channel on 2026-07-16.

Do not open a public issue, pull request, or discussion for an undisclosed vulnerability. Include affected versions or surfaces, reproduction steps, impact, and any suggested mitigation. Avoid accessing or retaining data that is not yours.

The maintainer will acknowledge the private report when practicable, investigate it, and coordinate remediation and disclosure through the advisory. Response or fix timelines are not guaranteed.

Cabadrive is currently a local-first static application without a runtime backend. Security support covers the current default branch and the latest published build; older snapshots may not receive fixes.