squi connects to databases, often production ones, through SSH tunnels and with saved credentials, so security reports are welcome and taken seriously.

Only the latest release gets fixes. Update with :update inside squi, brew upgrade squi, scoop update squi or a fresh package from the releases page.

Please don't open a public issue. Report it privately through GitHub security advisories with the squi version, the engine involved and the steps to reproduce. You should get an answer within a few days.

Useful areas to look at: how passwords reach the OS keychain and memory, SSH host key checking and known_hosts handling, the read-only and production safeguards, SQL generated by inline edits, imports and squi diff, and the self-update that replaces a downloaded binary.