Please report security issues privately to me@ocramer.com rather than in a public issue: anything that could expose a Steam sign-in token, a password, or a user's files.

Shiori keeps the Steam sign-in token in iCloud Keychain and never stores passwords. It has no server of its own.