Only the latest release receives fixes. StudyApp updates itself through Sparkle, so please update before reporting.

Please do not open a public issue. Report it privately through GitHub security advisories with steps to reproduce and the affected version. You will get an answer within a week.

Relevant areas are the Stud.IP sign-in (credentials and session in the keychain), backup archives (paths inside an archive are validated before extraction) and the update feed (DMGs are signed with EdDSA).