Security fixes are provided for the latest released version of elio.

If possible, test suspected vulnerabilities against the newest release before reporting. If you can only reproduce the issue on an older version, include that version in the report.

Please do not open a public GitHub issue for suspected security vulnerabilities.

Report vulnerabilities through GitHub private vulnerability reporting for this repository:

https://github.com/elio-fm/elio/security/advisories/new

When reporting, please include:

• the affected elio version or commit
• your operating system and terminal
• a clear description of the issue
• reproduction steps or a proof of concept, when possible
• whether the issue depends on a crafted file, archive, path, config, theme, or terminal escape sequence
• whether the issue depends on optional external tools such as ffmpeg, ffprobe, pdfinfo, pdftocairo, resvg, magick, 7z, bsdtar, or isoinfo

We aim to acknowledge new reports within 7 days. Reports will be triaged, and confirmed vulnerabilities will be fixed and disclosed with appropriate release notes once a fix is available.

elio is a local terminal file manager. It does not run a server, accept remote logins, or intentionally process untrusted network requests.

Security-sensitive areas include:

• previewing malformed or malicious local files, archives, documents, media, or images
• invoking optional external preview tools
• opening files or folders with platform launchers and discovered applications
• handling unusual filenames, paths, symlinks, mounts, and trash operations
• copying file metadata to the clipboard, including through OSC52 and platform clipboard helpers
• rendering terminal output, including terminal escape sequences
• parsing user-provided config and theme files

If you are unsure whether a behavior is security-sensitive, report it privately.

Rust dependency advisories are tracked as part of regular maintenance.

The contributor workflow for local dependency auditing is documented in CONTRIBUTING.md. unsound RustSec advisories are treated as release blockers. Known unmaintained advisories in transitive dependencies may be tracked without blocking a release when there is no practical fixed upgrade path.