Report it privately, through GitHub's private vulnerability reporting: Security › Report a vulnerability. Please do not open a public issue for it.

Say what is affected (the desktop app, the console, an MCP server, the vault, the brain), the version, and how to reproduce it. You get an answer as soon as possible; a fix goes into a release, and the advisory is published with it, crediting you if you wish.

Only the latest stable release, and the latest beta while one is open, get security fixes. The app updates itself, so staying current is the default.

How secrets, sessions, the brain and updates are protected is described in Security on the site.