Security reporting

Report a security problem privately, through GitHub's private vulnerability reporting on the repository concerned (the Security tab, then Report a vulnerability), not through a public issue. Each repository's SECURITY.md says the same and names the contact.

Every repository has secret scanning and push protection on, Dependabot alerts, and a protected main branch. The full git history of each was scanned before the repositories were made public on 7 November 2026.

What data the apps hold, where it is stored, how keys and secrets are managed, and the sub-processors involved are set out in the security answer pack in the triodian-install repository, which is published on this site after counsel's review.