Please do NOT open a public issue for security vulnerabilities.

Email the maintainer via the contact form at the live instance, or use GitHub's private vulnerability reporting ("Report a vulnerability" under the Security tab) on this repository.

You'll get an acknowledgment within a few days. Fixes for confirmed issues in the web app ship quickly — it's deployed continuously.

• Web app (src/), Chrome extension (extension/), macOS app (desktop/)
• Self-hosting misconfigurations are appreciated as reports too, especially anything the docs encourage that turns out to be unsafe.

The main branch and the latest tagged release.