InTab Tools builds privacy-first tools that run on your own device. Our main promise is that your files never leave your device. If you find something that breaks this promise, or any other security problem in one of our projects, thank you for telling us. Please do it privately first.

Please do not open a normal public issue for a security problem. Our repositories are public, so everyone can see issues.

Option 1: GitHub private reporting (preferred)

1. Open the repository that has the problem.
2. Go to its Security tab.
3. Click Report a vulnerability.
4. Tell us what you found, how to repeat it, and which browser, device or app version you used.

If you do not see the Report a vulnerability button, use the email option below.

Option 2: Email

If you cannot or do not want to use GitHub, email intabtools@gmail.com with "Security" in the subject line. Please do not put full exploit details in any public place.

• Anything that sends a user's file, file name or file content over the network
• Tracking, analytics or third-party scripts
• A weaker Content-Security-Policy
• A crafted file that crashes an app or runs unwanted code
• Weaker desktop app security settings (for example Electron context isolation or sandbox turned off)
• A new Android permission, or a plugin that talks to a server
• A leaked signing key, keystore, password or other secret
• A known vulnerability in a library we use

If you only have a question about our privacy rules, open a normal issue in the project's repository with the privacy label.

We are a small student team, so we cannot promise a fixed time. We will try to reply within 7 days, fix confirmed problems quickly, and explain what happened in simple words. If you like, we will happily mention your name as a thank you.

Please give us a chance to fix the problem before you share the details publicly. We welcome good-faith security research, and we will not take action against people who report problems responsibly.

Our apps are only distributed through official places: the GitHub Releases page of each project, and the official store listings (such as the Microsoft Store and F-Droid) linked from that project's README. Anything else is not ours. If you find a fake copy of one of our apps, or a channel pretending to be us, please report it the same way as a security problem.

For each project, only the latest release is supported. A project's own SECURITY.md, if it has one, takes priority over this file.