Security fixes are accepted against the latest main branch of Omni-Rewriter.
Please do not open a public issue for sensitive reports. Prefer a private GitHub security advisory on WayneJin0918/Omni-Rewriter when available, or contact the repository owner via GitHub.
Include:
- Affected component (CLI, API, media loader, adapters)
- Reproduction steps
- Impact assessment
- Omni-Rewriter fetches optional media with address / redirect / size limits; treat media URIs as untrusted input.
- Do not paste API keys into issues, fixtures, or traces.
- Prompt dumps and skill archives under
docs/references/are sanitized public contracts, not credentials.