Strata reads your whole disk and can delete files, so security and data-safety reports are taken seriously.

Only the latest release receives fixes.

Please don't open a public issue. Report it privately through GitHub instead:

1. Go to the repository's Security tab.
2. Click Report a vulnerability (direct link).
3. Describe the issue, the affected version, and steps to reproduce. Include a proof of concept if you have one.

You should get a first answer within a few days. Once a fix is ready, it ships in a new release and the advisory is published with credit to you (unless you prefer to stay anonymous).

Examples of things worth reporting:

• Strata deleting, or offering to delete, files outside what the user selected, or protected system locations.
• Deletion following a junction or symlink into another location.
• Ways for a crafted file name, path or scan file to run code, or for the UI to reach the file system or network other than through the app's commands.
• Anything that makes the updater install a file that wasn't signed with Strata's update key, or that sends information about the user.
• Problems with the "restart as administrator" flow.

General bugs and wrong cleanup suggestions that don't put data at risk are better reported as regular issues.