Please report vulnerabilities privately through GitHub's private vulnerability reporting: open this repository's Security tab and choose Report a vulnerability. Do not open a public issue, pull request or discussion for a security problem.

Include what is affected (self-hosted server, Docker image or desktop app, and the version or commit), how to reproduce it, and the impact you expect.

Security fixes go into the latest release (desktop app and Docker image). Upgrade to it before reporting a problem found in an older version.

The security model is described in the documentation: the self-hosted server's login and session handling under Self-host: Security, and the desktop app's hardening under Security model.