Do not open a public issue for security vulnerabilities.

Please report via GitHub Security Advisories (Private Vulnerability Reporting).

Include:

• Description of the vulnerability
• Steps to reproduce
• Affected version
• Suggested fix (if any)

• Acknowledgment: within 72 hours
• Initial assessment: within 7 days
• Fix or mitigation: depends on severity, targeted within 30 days

Boxing is a client-only browser extension. All data is stored locally. The only outbound network access is user-configured WebDAV or GitHub Gist backup. No analytics, no tracking, no third-party services.