Please report it privately on GitHub: Security → Report a vulnerability. Don't open a public issue.

Include which part is affected (server, CLI or iPhone app), the version (rendu -v; the server's is in rendu status), and how to reproduce it.

Only the latest release is supported. The iPhone app isn't released separately, so its fixes go to main.

Behavior described under Security and privacy isn't a vulnerability by itself. For example, the database isn't encrypted at rest.