Report suspected credential leaks or security vulnerabilities privately using GitHub private vulnerability reporting. Do not include IBKR tokens, Ghostfolio credentials, account identifiers or real transaction exports in public issues or pull requests.

Security fixes target the current main branch. Older releases do not receive separate backports. Dependency and image security checks run on pull requests and weekly; merging a fix publishes an image but does not deploy a running container.