If you find a security issue, please open a private report via GitHub Security Advisories on this repository, or email Zikr Apps at salam@zikrapps.com. Do not file public issues for exploitable vulnerabilities.

• This app does not ship API keys or backend credentials in source code.
• Android signing keys are managed by EAS; do not commit .jks, .p12, or credentials.json.
• For CI builds, store EXPO_TOKEN only in your CI secret store (e.g. GitHub Actions secrets).

• Prayer/dhikr counts and goals are stored locally on the device via AsyncStorage.
• There is no in-app account system or analytics SDK in the current codebase.
• PDF export and external links (Quran.com, Sunnah.com) are initiated by the user.

Run npm audit periodically. Most reported issues are in dev/build tooling, not runtime app code.