Report vulnerabilities privately using GitHub private vulnerability reporting. Do not publish exploit details, tokens, private messages or customer data in an issue or PR. Include the affected revision, a minimal synthetic reproduction, expected/actual behavior and impact. Coordinate disclosure with the maintainer. There is no paid bounty or guaranteed response time.

Security fixes target current main; older snapshots are not maintained release lines. Hosted operators must track fixes, test upgrades and maintain backups. Local development checks are not proof that a public deployment is secure.

If a credential leaks, revoke or rotate it at its provider first, update the service binding, then verify the old credential is rejected. Deleting a file or rewriting Git history alone does not revoke a credential. Never include the credential itself in a report or verification receipt.

Security research against your own local instance or a disposable test deployment, conducted in good faith and reported through the channel above, is welcome. Do not probe the hosted production service (room.trydemigod.com) beyond normal use, do not access other users' data, and do not disrupt the service. Reports that follow these rules will not be treated as abuse.

There is no maintainer PGP key published for this project. For sensitive reports, use GitHub's private vulnerability reporting (linked above), which keeps the report visible only to the reporter and the maintainers. Do not email plaintext exploit details, tokens, or private data anywhere.

For architecture and isolation boundaries, see SECURITY-MODEL.md and DATA-BOUNDARIES.md. The self-host guide explains the supported single-node shape and recovery limitations.