Please use GitHub's private vulnerability reporting feature for this repository. Do not open a public issue containing an exploit, API key, private server address, photo metadata, or local filesystem details.

Include the affected commit, reproduction steps using synthetic data, and the expected safety boundary. Reports involving source modification, overwrite behavior, path traversal, checksum bypass, Keychain disclosure, SQL writes through the inspector, or unintended network requests are especially important.

Security fixes are applied to the latest commit on main while the project is pre-1.0.