Do not publish vulnerabilities containing account data. Use GitHub's private vulnerability reporting if available. Never attach tokens, passwords, databases, configuration backups, invitation links, signing keys or book content.

The client uses verified HTTPS, private sessions, restricted offline HTML and signature/hash verification for updates. These measures do not replace an independent security audit. The optional Kavita adjustment is version-specific and must keep anonymous requests denied.

Test credentials and fixtures are synthetic. Signing keys and operational data are not part of this repository.