Please do not open a public issue for a security problem.

Email security@jotnotes.com with:

• what you found, and what someone could do with it;
• the version (/health on the box, or the release you installed) and how the box is set up;
• the steps to reproduce it.

You will get a reply within a few days. A confirmed problem is fixed in a release first, and described in CHANGELOG.md once people have had a chance to upgrade. If you would like to be credited, say so.