There is no server, no backend, no account system and no API. Nothing is transmitted, so there is nothing in transit to intercept and no stored credential to leak. That removes most of what a security policy usually covers, and leaves three things that genuinely matter here.

The built bundle. The landing page tells visitors that the app makes no network requests after it loads, and invites them to open devtools and check. Anything that makes that false is a security problem in this project, not merely a bug — a dependency that phones home, a <link> to a CDN, an error reporter added in a hurry. npm run verify checks the built output for exactly this and runs on every pull request, but a way past it is worth reporting.

Imported documents. Maps arrive from JSON and Markdown files that may be hand-edited, truncated, or produced by something else entirely. Every document is validated on the way in and again before every save. A crafted file that executes script, escapes into the DOM, or gets written to the store without passing validateDoc is the highest-severity class of bug this app has.

Stored data. Maps live in this browser's IndexedDB and a crash-recovery draft in localStorage. Anything that lets one origin, one map, or one tab read or destroy another's data belongs here.

Use GitHub's private vulnerability reporting: Report a vulnerability

Please do not open a public issue for anything in the three categories above until it has been fixed.

Include what you did, what happened, and the browser and version. If a particular document triggers it, the smallest map that still reproduces it is the most useful thing you can attach — and be aware that a map export contains whatever you typed into it, so send a synthetic one rather than a real one.

There is no bounty. This is a small tool given away under the MIT licence.

• Anyone with access to the browser profile can read the maps. They are stored unencrypted, as local application data. This is the documented behaviour of a local-first tool, and the trade-off is stated on the landing page and in the README.
• Clearing site data deletes every map. So does uninstalling the browser. Backups exist for this; see Settings → Download a backup.
• A browser short of disk space may evict the data. Settings asks it not to via navigator.storage.persist() and reports the answer.
• The react-router advisory reported by npm audit. It is specific to RSC mode, which this app has no server to run. See CONTRIBUTING.md for why the pin stays and why the output is not suppressed.

The deployed site tracks the default branch. There are no release branches and no backports — a fix lands there and is deployed. A self-hosted copy is the host's to update.