Only the latest release of Goddard receives security fixes. Updates ship through the in-app updater and https://goddardai.org.

Please use GitHub private vulnerability reporting: https://github.com/goddard-ai/goddard/security/advisories/new

If that doesn't work for you, email security@goddardai.org.

Please don't open a public issue for anything you believe is exploitable before it has been fixed. Include reproduction steps and the Goddard version (Goddard → About Goddard) you tested.