Do not disclose possible vulnerabilities in public GitHub Issues.

Use GitHub private vulnerability reporting where available, or email [email protected].

Please include concise reproduction steps, the affected app and context, observed impact, and whether the behaviour is repeatable. Remove customer content, credentials and personal information from screenshots or logs.

Caffeine and Cashflow does not operate a bug-bounty programme, offer financial rewards, or promise 24/7 incident response.