If you discover a security vulnerability in OpenMemo, please report it responsibly.

Please do NOT open a public GitHub issue for security bugs.

Instead, email us at security@openmemo.app with:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

We will acknowledge receipt within 48 hours and aim to provide a fix within 14 days.

• We will investigate all reports promptly.
• We will coordinate a fix and release before any public disclosure.
• We will credit reporters who wish to be named in the release notes.
• We ask that reporters give us reasonable time to fix before disclosing publicly.