This project runs locally, performs no network calls (there is no phone-home anywhere), and stores no credentials.
To report a vulnerability (e.g., an unsafe file operation, a command-injection vector, a config-parse issue):
- Preferred: open a GitHub Security Advisory on this repository (private disclosure).
- Or email the maintainer at the address listed on the owner profile.
Include: platform + version, steps to reproduce, and impact if you can. We will acknowledge, fix, and credit (or keep anonymous, your choice) — usually quickly for a solo-maintained hobby project.
Do not disclose publicly until a fix is available.