InTheKnow holds accounts, passwords, two-step verification secrets and calendar links that carry access tokens, so security reports are welcome.

Please do not open a public issue. Report it privately through GitHub instead: report a vulnerability.

Include what you can:

• what is affected (page, API route, setting) and what an attacker gains;
• steps to reproduce, or a proof of concept;
• the commit or version you tested.

Please test only against your own installation, and never against other people's accounts or calendar links.

This is a hobby project maintained by one person, so responses are best effort. I aim to acknowledge a report within a week, keep you updated while I work on a fix, and credit you in the fix unless you prefer not to be named.

Only the latest commit on main receives security fixes.