Please report security vulnerabilities through GitHub private vulnerability reporting on this repository. Open the Security tab and choose "Report a vulnerability". This keeps the report private until a fix is available.

Do not open a public issue for security problems, and do not include secrets or real personal data in a report.

Unflincher is a single-user, self-hosted application. The most sensitive assets are your local SQLite database and your GitHub Copilot token. Reports about data exposure, a bypass of the Cloudflare Access boundary, or token handling are in scope.