Mutabaa is a static site and a small command line tool. It has no accounts, no server and no stored user data. See docs/SECURITY.md for the threat model, the controls and what is not covered.

Open a private security advisory on the GitHub repository (Security tab, "Report a vulnerability"). Please do not open a public issue for a vulnerability.

Include the page or command involved, the steps to reproduce it and what you expected. Reports about wrong data in the ledger are not security reports: use the correction template in .github/ISSUE_TEMPLATE.

Only the latest tagged release.