Do not report security vulnerabilities in public issues, discussions, pull requests, or release comments. Use GitHub Private Vulnerability Reporting instead.

Include a clear description of the impact, affected versions, reproduction steps, and a minimal proof of concept where possible. Do not include private credentials, account details, or proprietary game files.

Reports will be acknowledged within seven calendar days. The maintainer will work with reporters to validate the issue, prepare a fix, and coordinate public disclosure after affected users have a reasonable opportunity to update.

This policy covers vulnerabilities in the LinUwUx runtime, wrapper, installer, and release artifacts. It does not cover compatibility bugs without a security impact or vulnerabilities in Wine, Proton, games, launchers, Linux distributions, or drivers that LinUwUx does not maintain.