Shotcandy is a static website. It has no server, no accounts and no database, and your images are processed in your browser. Even so, bugs that could leak a user's images, run untrusted code, or break the "nothing is uploaded" promise matter a lot.

Please report security issues privately, not in a public issue:

• use GitHub's private vulnerability reporting for this repository, or
• contact the maintainer, Bilal Tahir, through GitHub.

Include what you found, how to reproduce it, and which browser you used. You'll get a reply as soon as possible, usually within a few days, and credit in the changelog if you'd like it.

Only the latest version, the one running at shotcandy.app and on the main branch, gets fixes.