Square-Pot has no release yet. Until the first release, only the latest commit on main receives security fixes.

Please do not report security problems in public issues, discussions or pull requests.

Report them privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Include:

• the affected component (server, Android app, web app, bot, deployment);
• the version or commit;
• steps to reproduce, or a proof of concept;
• the impact as you understand it.

We aim to acknowledge a report within 7 days and to agree on a disclosure date with you once a fix is ready. We will credit you in the advisory unless you prefer to stay anonymous.

Square-Pot is self-hosted. Problems in how a particular instance is configured or operated are the operator's responsibility. Problems in the code, the default configuration or the deployment files in this repository are in scope, as is any way to read or modify another user's collection or spreadsheet.