Only the latest released version receives security fixes.

Please do not open a public issue for vulnerabilities involving permissions, activation, secrets, task isolation, candidate attribution, or verification bypasses. Use GitHub's Report a vulnerability flow in this repository instead. Include affected versions, reproduction steps, impact, and any suggested mitigation.

Never attach live OpenCode/OpenChamber configuration, credentials, task artifacts, session exports, or unredacted runtime logs.