Security fixes are evaluated against the latest published HASHME release.

Do not open a public issue for a suspected vulnerability. Send a concise report to the dedicated HASHME security address: hashme256@proton.me.

Include the affected version, reproduction steps, impact, and any suggested mitigation. Never send signing keys, certificate passwords, or unrelated private files.