I apply security fixes to the latest release.

Please use GitHub private vulnerability reporting. Do not open a public issue containing an undisclosed vulnerability or sensitive diagram data.

Include the affected browser, a minimal reproduction, and the expected impact. I aim to acknowledge a report within seven days.

Nodes runs entirely in the browser. I designed it so diagram content is not sent to a remote service. Saved projects use local browser storage, while downloaded project and image files are handled by the browser itself.