Only the latest release receives security updates. Please ensure you are running the most recent version before reporting.

Do not open a public issue for security vulnerabilities.

Instead, please report vulnerabilities through GitHub Security Advisories.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• 48 hours -- Initial acknowledgment of your report
• 7 days -- Assessment and severity classification
• 30 days -- Target for a fix in a new release (may vary based on complexity)

We will keep you informed of progress throughout the process. Once the issue is resolved, we will credit you in the release notes (unless you prefer to remain anonymous).

This policy covers the Exile Build PoE desktop application, including:

• Electron main process and preload scripts
• IPC communication handlers
• Network requests (PoB import, auto-update)
• Local data storage

Third-party dependencies are managed via Dependabot. If you find a vulnerability in a dependency, please still report it here so we can assess the impact on our application.