If you believe you’ve found a security issue in Crest, please do not open a public issue.

Instead, email: koustavganguly24@gmail.com.

You can also use the project site contact: iamk.xyz.

Please include:

• What you found and why it’s impactful
• Steps to reproduce (PoC if possible)
• Your environment (distro, desktop, Wayland/Xorg)

• Crest is local-first and does not ship telemetry.
• Extensions/plugins execute as separate processes; by default Crest runs only scripts listed in the user’s manifest file.