Please do not open a public GitHub issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting feature on this repository's Security tab.

We aim to acknowledge reports within 7 days.

The following are in-scope:

• Authentication / authorization bypass
• Remote code execution
• SQL / NoSQL / command injection
• Path traversal
• Exposure of user data or secrets

Out of scope:

• Self-XSS requiring the victim to paste attacker-controlled code into devtools
• Denial of service via resource exhaustion (this is a local-first app)
• Issues requiring physical access to the user's machine

Once a fix is prepared, we coordinate disclosure with the reporter and publish an advisory.