Please report security problems privately rather than in a public issue: use Report a vulnerability on the repository's Security tab. Include what you found and how to reproduce it. You'll get a reply as soon as possible.

Things worth knowing:

• Your data: OpenMacro keeps it on your phone, with no account and no server.
• AI logging: your API key is stored outside the database, in a folder Android's backup skips, and it's never included in backup files. Photos and descriptions go only to the AI service you choose, and only when you log with AI.
• Updates: they come from this repository's GitHub Releases, and every release is signed with the same key.