Any security issues can be reported to the main author at kenneth@duplicati.com.

If the issue is sensitive, the [PGP signing key](https://keys.openpgp.org/search?q=0xC20E90473DAC703D) can be used for encryption.