If you find a vulnerability in PushThat, please report it privately rather than in a public issue or pull request, so that it can be fixed before it is described.

• Use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability), or
• email hello@pushthat.link.

Say which part is affected (the web app, the Chrome extension, the Cloud Functions, the Firestore or Storage rules, the Android, iOS or macOS app) and how to reproduce it. You should hear back within a few days. Fixes ship to pushthat.link, the extension and the apps, and to the main branch.