Please do not open a public issue for a suspected vulnerability. Email hello@d7om.dev with:

• the affected version or commit
• what an attacker can do, and what they need first
• steps to reproduce, ideally against a fresh install with demo data
• any suggested fix

Do not include real documents, credentials, tokens or personal data. You should get an acknowledgment within seven days. Please give us reasonable time to ship a fix before disclosing publicly.

Only the latest release of Waraq receives security fixes.

How Waraq protects the owner account, sessions, documents and share links, and what remains the operator's job, is described in docs/SECURITY.md.