douane holds subscription credentials, so a flaw in it can expose accounts. Please report vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue.

Include the version or commit, your setup (listener, reverse proxy, management token) and the steps to reproduce. Never attach real credentials, account files or request logs; a redacted excerpt is enough.

Only the latest commit on main receives fixes.