Please report security issues privately to hej@ksefuj.to, not in a public issue. Include the affected repository, steps to reproduce and the impact you expect.

We reply within 7 days. Issues that could expose invoice data are our top priority: ksefuj is built on the promise that invoice content stays in the user's browser.

Fixes go into the latest release of each project; older versions are not patched.