Please do not disclose vulnerabilities in a public issue. Report them privately to the repository maintainers with a description, affected version, reproduction steps, and an assessment of impact.

Vault is local-first and does not provide account recovery. If a master password or backup password is lost, the encrypted data cannot be recovered by the application.

Until a fix is available, avoid sharing database files or .vault backups with anyone who does not need access to them.