gsc-hub stores Google OAuth tokens and service keys in a local SQLite file, so security reports matter even for a self-hosted tool.

Please report a vulnerability privately - through GitHub's Report a vulnerability button on the repository's Security tab, or via Telegram @izzypizzy_seo. Do not open a public issue for it.

Include the version (footer or package.json), how the instance is deployed (loopback, Docker Compose, exposed with login) and steps to reproduce.