Please do not open a public issue for sensitive security problems.

Report security concerns privately to the repository owner through GitHub, or open a minimal issue that asks for a private contact path without including exploit details or personal data.

WordTree is local-first. Practice records are stored on the user's device through browser/WebView storage. Do not paste personal learning records, exported localStorage data or screenshots containing private notes into public issues.

The Electron desktop wrapper denies new in-app windows and opens external links in the system browser. This reduces the amount of untrusted web content loaded inside the application shell.

Dependencies are resolved through package-lock.json. Security fixes should avoid broad upgrades unless they are needed to address a specific issue.

Never commit signing certificates, private keys, Android keystores, Apple credentials or CI secrets to the repository.