Please report security problems privately through GitHub's private vulnerability reporting (the repository's Security tab → "Report a vulnerability"). Do not open a public issue.

We are especially interested in anything that could expose a user's private library, titles or practice data — to the operator, to other users or to third parties — and in weaknesses in the encrypted backup and sync design (spec §10).

We aim to acknowledge reports within a week. OpenTiles is maintained by volunteers, so please allow reasonable time for a fix before disclosure.