Please do not disclose security vulnerabilities in a public issue. Use GitHub's private vulnerability reporting for this repository when available, or contact the repository owner privately through GitHub.

Bookward is designed for self-hosting. Never commit .env files, database files, API keys, webhook URLs, SMTP credentials, or generated secret keys. Rotate any credential that is accidentally exposed.