Only the latest minor release (currently 1.3.x) receives security fixes.

Please do not open a public issue. Use GitHub's private vulnerability reporting or email kou.real@outlook.com. Expect an acknowledgement within 72 hours.

Ruas runs fully offline and sends no code to external services. Relevant issues include path traversal during indexing/export, arbitrary file write via docgen/export/vibe, and unsafe handling of untrusted repositories by the MCP server.