0.1.x is experimental. Use GitHub private vulnerability reporting for this repository when enabled, or ask a maintainer for a private reporting channel. Do not post exploit details or private documents in a public issue. No unmonitored security email address is advertised. Include versions, reproduction and impact.

PyDeskUI displays data; it does not evaluate scripts, render HTML, capture the screen or install plugins. Applications remain responsible for input/resource limits.