Report suspected vulnerabilities privately through GitHub's vulnerability reporting form. Include the affected Carbide/Flutter versions, platform, a minimal reproduction, the impact and any proposed mitigation. Avoid credentials, personal data and unnecessary exploit material in the report.

The maintainer reviews reports affecting the latest published Carbide release and current development branch. Fix timing depends on impact and available reproduction evidence; no response deadline or long-term support promise is implied. Coordinated disclosure lets consumers receive a fix before details are published.

Ordinary styling, layout and non-security accessibility defects belong in public issues. Application upload transport, authentication, storage policy and platform permissions remain the host application's responsibilities; see the file-upload integration guide.