If you find a way to read room content you shouldn't, to run code on someone else's device, to make the desktop app reach something it shouldn't, or to get a false update accepted, report it privately:

https://github.com/forgesworn/kithmoot/security/advisories/new

Please don't open a public issue for these. Only the project's maintainers see a private report, and you can discuss it with them in the same place until a fix is out. Problems in the Android app can be reported here too.

An ordinary bug, or a connection the app makes that Check it yourself doesn't list, can go in a public issue.

Only the current release of the web app, the desktop app and the Android app. Update to it before reporting, if you can.

Check it yourself lists everything the desktop app connects to and can touch on your computer, with a command to check each claim. Anything it does beyond that list is a bug.