Report suspected security or privacy issues privately to the repository owner before opening a public issue. Do not include real activity databases, browser history, window titles, tokens, or screenshots containing private information.

The project accepts fixes for data exposure, spreadsheet formula injection, unsafe network defaults, and dependency or supply-chain risks.