# Security Policy

## Supported version

Security fixes are applied to the latest released version.

## Reporting a vulnerability

For a non-sensitive bug, open a GitHub issue.

For a security-sensitive report, use GitHub's private vulnerability reporting or security-advisory interface for this repository when available. Do not publish proof-of-concept details until a fix is available.

Never include Bilibili cookies, authentication data, complete signed media URLs, private video information or other personal data in a report. A redacted host name, video ID and reproduction outline are normally sufficient.

The project does not operate a backend service and does not request proxy, cookie, browsing-history or all-sites permissions.