We take the security of Taeafi seriously. If you discover any security vulnerability, we appreciate your help in disclosing it responsibly.

⚠️ DO NOT open a public issue for security vulnerabilities.

When reporting, please provide:

With your permission, you will be:

• Credited in the security advisory
• Listed in our Security Hall of Fame
• Notified when the fix is deployed

📝 Note: Data is stored in plain text JSON in the browser's LocalStorage. This is acceptable because:

1. No sensitive personal data is collected
2. Users can use aliases
3. Data never leaves the device
4. One-click deletion is available

• ❌ Passwords ❌ Credit card info
• ❌ Email addresses ❌ Phone numbers
• ❌ Real names ❌ Addresses
• ❌ Location data ❌ IP addresses
• ❌ Browsing history ❌ Device fingerprints
• ❌ Cookies ❌ Any PII (Personally Identifiable Information)

• No server-side code — no backend vulnerabilities
• No database — no SQL injection risk
• No user authentication — no credential theft risk
• No file uploads — no malware injection risk
• No third-party scripts (except CDN fonts/icons)
• No eval() or Function() constructors
• No cookies — no cookie theft risk
• Content Security Policy compatible
• HTTPS enforced (via GitHub Pages)
• Minimal data collection
• One-click data deletion
• Full source code transparency

• Security patches are prioritized over feature updates
• Critical vulnerabilities are patched within 48 hours
• Users are notified via app notifications (if enabled)
• All changes are documented in release notes

We follow the principle of responsible disclosure:

1. 🔍 Discover — Security researcher finds vulnerability
2. 📧 Report — Private report to developer
3. ⏳ Wait — Allow time for fix development
4. 🔧 Fix — Developer creates and tests patch
5. 📢 Disclose — Coordinated public announcement
6. 🏆 Credit — Researcher receives recognition

🔒 PGP Key: Not available yet — will be added in future releases.

• OWASP Top 10
• Web App Security Best Practices
• PWA Security Considerations
• LocalStorage Security

Security is a shared responsibility. Thank you for helping keep Taeafi safe! 🛡

_{Last updated: 2026}