Oscura's single promise is that redacted output contains no trace of the redacted data. Anything that breaks that promise is a security vulnerability, not a bug:

• recovering original text or pixels from a redacted file (any format);
• residual metadata that identifies a person (Office properties, revision authors, EXIF, embedded thumbnails…);
• a failure mode where the app emits unredacted bytes instead of aborting;
• path traversal / zip handling issues exploitable through a crafted document.

Detection misses on well-formed input (a name the engine didn't recognise) are accuracy issues — report those as ordinary GitHub issues with a synthetic example.

Use GitHub private vulnerability reporting ("Report a vulnerability" under the Security tab of this repository). Include a synthetic reproduction document — never real personal data.

You can expect an acknowledgement within a week. Please allow up to 90 days for a fix before public disclosure; releases with security fixes are noted as such in the release notes.

Only the latest release is supported. There is no backporting.