This is unreleased development software. Avoid sole-copy production use and back up your vault. Do not publish a personal diary, tokens, keystores or unredacted diagnostic dumps in an issue.

Use GitHub's private vulnerability reporting for styayur/gitpad-plus when available. If it is unavailable, open a minimal public issue requesting a private contact without disclosing exploit details or private data. No private reporting address is fabricated here.

See docs/SECURITY.md for the current trust model and known limitations. Release requires dependency audits, license review, safe-clear tests and real native runtime evidence.