Security fixes are made on the latest released minor version and on main. Pre-release builds are supported only until the next pre-release or stable release is available.

Do not disclose a suspected vulnerability in a public issue. Use GitHub private vulnerability reporting so the report and any proposed fix remain private until a coordinated release.

Include the affected First Draft and Obsidian versions, operating system, reproduction steps, impact, and any suggested mitigation. Use a minimal test vault and never attach real screenplay content, credentials, or other personal data.

You should receive an acknowledgement within seven days. Confirmed issues will be assessed, fixed on a private branch, and disclosed with an appropriate security advisory and patched release. Timelines depend on severity and the complexity of a safe fix.