Please report suspected security problems through the repository's private security advisory form:

https://github.com/Desir-16/DailyTracker/security/advisories/new

Do not publish private backup files, account details, signing credentials, or proof-of-concept material containing personal information in a public issue.

Official APK releases are signed with the same permanent production certificate. Verify the SHA-256 checksum supplied with each release when authenticity is important.