# Security and independent inspection

Public inspection, good-faith testing, and responsible reporting are welcome.
The published application is not intended to contain malware, spyware, hidden
tracking, credential theft, or other malicious behavior.

Source publication and automated checks reduce uncertainty; they do not prove
that software is permanently free from every bug, vulnerable dependency,
supply-chain risk, server compromise, or future unauthorized change.

When the public GitHub repository is active, security concerns should be
reported through GitHub's private vulnerability-reporting feature rather than
posted publicly before the issue can be reviewed. A dedicated security contact
will also be added to `/.well-known/security.txt` before final production
release.
