Report security problems privately through GitHub's private vulnerability reporting, not in a public issue or pull request. Please give the maintainer reasonable time to fix a problem before disclosing it.

In scope: anything that lets someone other than the configured login, on a configured device, use the app or reach the Hermes backend through it; ways around the Origin check, the device allow-list or the PC window guards; leaks of the backend token.