Please open a private security advisory if the repository is hosted on GitHub with that feature enabled. If private advisories are not available, open an issue with a minimal description and avoid posting secrets, tokens, or logs that contain credentials.

Useful reports include:

• credential leakage
• accidental logging of tokens or credentials
• unexpected browser cookie access
• sending provider tokens to the wrong endpoint
• reading files outside the documented local usage paths

This project is currently a small personal utility. Security fixes are expected to target the main branch.

• Tokens must not be logged.
• CLI sign-in tokens must be read-only and used only for enabled sync sources. macOS official sync is opt-in; Windows release 0.4.7 checks sync selections by default but requires explicit, successfully saved Start sync approval before reading sources, credentials, or making requests. Existing explicit off choices remain off. Windows v0.4.7 includes this approval gate.
• Provider data must not be mixed across providers.
• Browser cookie access is not implemented. Any future browser-cookie feature should go through a separate security review before release.