The latest public winTerm Stable release receives security support. Verify the GitHub Release URL, SHA256SUMS.txt, and GitHub provenance before installation. When Release notes mark an installer unsigned, Windows may show Unknown Publisher or a SmartScreen warning; no certificate import is required or recommended.

Do not open a public Issue for a suspected vulnerability. Do not publish credentials, tokens, private terminal output, commands, Workspace files, memory dumps, certificate material, or exploit payloads.

Use GitHub Private Vulnerability Reporting from this repository’s Security tab. If it is unavailable, contact the repository owner through GitHub and request a private channel before sharing technical details.

Relevant reports include arbitrary command execution, unsafe imports, secret or clipboard exposure, package identity confusion, unsafe update behavior, diagnostic-redaction failure, Workspace corruption, Docking ownership or live-session loss, and vulnerabilities in winTerm-maintained release automation.

Maintainers assess impact and affected versions through the private channel, coordinate a fix, and publish disclosure only after users have a reasonable opportunity to update. No response-time or bounty promise is made.

Microsoft Terminal vulnerabilities that are not introduced by winTerm should also be checked against the upstream Microsoft Terminal security process; do not imply that winTerm can coordinate a Microsoft response.