Report vulnerabilities privately to support@wovenleaf.app. Include affected versions, platform, reproduction steps and a minimal fictional fixture where possible. Do not post tokens, library exports, private notes, or account details in a public issue. Acknowledge/report fixes through this contact; no guaranteed response time or paid bounty is promised.

Only the current source and subsequently published builds receive fixes. Third-party dependencies keep their upstream support policies.

Libraries and imported files live locally. Device compromise, an unlocked device, browser storage exposure, provider behavior, and unsupported/DRM-protected books are not solved by publishing source. Back up your own library before testing builds. Never commit signing keys or .env secrets. Public source is checked with Gitleaks in CI; that is not a guarantee against every secret or privacy leak.