只为最新正式版修复安全问题。使用旧版本时请先升级到最新版，扩展和本地助手需要一起升级。
请不要开公开 issue。到仓库的 Security 页点击 “Report a vulnerability”，私下提交。
报告中请写明受影响的版本、复现步骤和可能的影响，有概念验证更好。
- 扩展与本地助手之间的 Native Messaging 通信
- 一键安装命令和安装脚本
- 下载文件和缓存捕捉的写入路径
- Cookie、Authorization 等凭据的处理
- 发送到外部工具（Aria2、HTTP 服务、本机程序、自定义协议）
- 流萤不绕过 DRM，这是有意的设计。
- 依赖扫描工具报告的漏洞，如果流萤的代码用不到相关功能（例如扩展从不使用 SSR），不构成可利用的问题。请说明它在流萤中实际会被触发的路径。
流萤由个人维护，通常一周内回复。确认后会在修复版本发布时公开安全公告，并在版本说明中致谢报告者（如你同意）。
Only the latest release receives security fixes. Please do not open a public issue. Report vulnerabilities privately via Security → Report a vulnerability, including the affected version, reproduction steps and impact.
Areas of interest: Native Messaging between the extension and the native helper, the install command and scripts, file write paths, handling of cookies and authorization headers, and external tool integrations. Not bypassing DRM is by design. Dependency advisories for code paths StreamFirefly never reaches (such as SSR) are not considered vulnerabilities unless you can show a reachable path.
StreamFirefly is maintained by one person; expect a reply within about a week.