Write to andrey@sitnik.es or use private vulnerability reporting.

We reply within 3 days and aim to release a fix within 30 days. After the fix is released, we publish an advisory in GitHub Security Advisories and credit the reporter unless they ask not to.

The hosted app on slowreader.app, the ghcr.io/hplush/slowreader image, and the source code in this repository.

Only the latest release gets security fixes.