Please report vulnerabilities privately through GitHub's Security → Report a vulnerability on this repository, not in a public issue. We acknowledge reports within three working days.

This package ships the CSS, fonts, images and WebGL code that fctl's web app and https://fctl.sh load in the browser. How fctl itself handles credentials, sandboxes and billing is in fctl's security docs.