Security fixes are applied to the latest released version of BillFit.

Use GitHub's private vulnerability-reporting flow:

https://github.com/ValerianXXX/billfit/security/advisories/new

Do not disclose a suspected vulnerability in a public issue before a fix is available. Include a concise description, affected version, reproduction steps, impact, and any suggested mitigation. Do not include real utility credentials or customer data.