Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not disclose an unpatched vulnerability in a public issue.

Include the affected ZotMD version, operating system, impact, reproduction steps, and any suggested mitigation. Remove API keys, local paths, state databases, private library records, and generated notes before submitting evidence.

Zotero Desktop's local API permits unauthenticated reads. Keep port 23119 bound to loopback and never forward or expose it to another machine. ZotMD's paper-source API requests no local write authorization, contacts no WebDAV server, and omits enclosure URIs and local paths from record representations and diagnostics.