Please do not disclose vulnerabilities in a public issue.

For vulnerabilities in Interpreter-maintained cua-driver behavior, report the issue privately to [email protected]. Include the affected version, platform, impact, reproduction steps, and any suggested mitigation. Do not include real user data, desktop recordings, or active credentials.

For vulnerabilities in unchanged upstream Cua components, also consult the upstream project's current reporting policy at https://github.com/trycua/cua/security.