Please report suspected vulnerabilities privately and responsibly.

• Preferred contact: <TBD security email>
• Alternative: open a GitHub issue with minimal public detail and request private follow-up.

Please include steps to reproduce, affected components, and potential impact.

BrightSteps is local-first and should avoid collecting sensitive user data, especially child-related data.

Contributions that introduce tracking, telemetry of personal data, or unnecessary remote data collection are out of scope unless explicitly approved with strong safeguards.