The security and privacy of our merchants' product data is paramount. List Guard is built around a zero-cloud-footprint model where catalog data is processed ephemerally or stored client-side using AES-GCM encryption.

If you discover a security vulnerability within List Guard:

1. Do not create a public GitHub issue.
2. Send a report with full reproduction steps to the repository maintainer via GitHub Private Security Advisories.
3. Include:
   • Type of issue (e.g., HMAC timing leak, CSRF vulnerability, OAuth scope bypass).
   • Detailed proof of concept.
   • Any remediation advice you have.

We aim to acknowledge reports within 48 hours and provide a patch within 7 days.