Only the latest release of Dinosaur receives security fixes. Updates ship through the in-app updater and https://github.com/abcwyc/dinosaur/releases.

Please use GitHub private vulnerability reporting: https://github.com/abcwyc/dinosaur/security/advisories/new

If that doesn't work for you, email hi@egoist.dev.

Please don't open a public issue for anything you believe is exploitable before it has been fixed. Include reproduction steps and the Dinosaur version (Dinosaur → About Dinosaur) you tested.