Security fixes target the current main branch. This starter is a local, single-user example, without authentication, cloud sync or encrypted storage. The example SQLite database is not a credential vault. Derived applications must assess their own data handling and distribution requirements.

Use GitHub private vulnerability reporting to report a suspected vulnerability privately. Include the affected commit, platform, reproduction steps and expected impact. Use synthetic data; do not include real credentials, tokens or user databases.

Please do not disclose exploitable details in public issues before a fix is available. No response-time or disclosure-date commitment is made.