Report vulnerabilities through GitHub Security Advisories. Do not file a public issue for a leak, path traversal, or auth bypass.
The latest tagged release is the supported line.
A useful report says what is affected, how to reproduce it, and what you already verified. If a tool drafted the report, run the steps yourself before sending it.
Out of scope for v0.1:
- Hosting the library on the public internet without a reverse proxy and TLS
- Sharing a sync token in client-side JavaScript (the token is for the agent only)
- Asking the Zotero adapter to fetch arbitrary URLs from item fields
PaperRelay stores other people's PDFs. Blob keys must stay under the data directory. The Folder adapter never writes the source tree. The Zotero adapter is read-only against the Local API.