Report a security problem privately: on GitHub, open the repository's Security tab and choose Report a vulnerability. Do not open a public issue for it.

Useful reports name the part (the web site, the patcher, the desktop app, a module) and the steps to reproduce it. Never attach firmware (.syx), snapshots, card images or anything made from them: describe the device and OS version instead.

The site runs entirely in the browser and uploads nothing; a report that firmware or user files leave the page is treated as a security problem.