Statify is an early open-source project. Security fixes are applied on the latest main branch. Please update with statify update (or pull the latest commit) after a fix lands.

Do not open a public GitHub issue for security problems.

Please report privately via GitHub Security Advisories.

Include:

• A clear description of the issue and its impact
• Steps to reproduce or a proof of concept (if available)
• Affected version / commit if known

We will acknowledge the report when possible and work on a fix before any public disclosure.

Statify stores config and OAuth tokens on your machine under the platform config directory (see statify config). Treat those files as sensitive:

• Do not paste Client IDs, tokens, or file contents into public issues or pull requests
• Prefer statify logout and deleting local config/data if you believe credentials were exposed

Statify uses PKCE and does not require a Spotify Client Secret.