Please do not disclose vulnerabilities, credentials, private journal data, precise location, camera content, or reproduction details in a public issue.

Use GitHub's private vulnerability reporting flow. Include the affected component, impact, reproduction steps, and any suggested mitigation. You should receive an acknowledgement within five business days.

Security fixes target the current main branch and the current TestFlight release candidate. Older builds are not independently supported.

Reports involving authentication, account deletion, private notes or photos, camera uploads, location, StoreKit, Edge Functions, or release credentials are especially important.