Only the latest release is supported. Security fixes are released as new versions; older versions are not patched retroactively.

If you believe you've found a security issue, please report it privately so it can be fixed before public disclosure.

The preferred way is GitHub's private vulnerability reporting:

1. Go to the repo's Security tab.
2. Click Report a vulnerability.
3. Fill in the details and submit.

Please include:

• A clear description of the issue.
• Steps to reproduce, if possible.
• The affected version.
• Any potential impact you see.

You should receive an acknowledgement and an initial assessment. Please avoid publicly disclosing the issue until a fix has been published.

Clickyy ships a .env.example for documentation only. Never commit real credentials to this repository:

• Never commit .env, .env.local, or any other local environment file.
• Never commit API keys (sk-…, sk-ant-…), Apple app-specific passwords, Apple IDs, team IDs, or GitHub tokens.
• Apple signing/notarization credentials and GH_TOKEN belong in your shell or a local secret manager, not in source control.

The app itself stores your AI provider keys locally via Electron's safeStorage on macOS; they are never sent anywhere except directly to the provider you configured.