Only the latest code on main is supported.

Please don't open a public issue. Use the repo's Security tab → Report a vulnerability, or contact @swapnilchaudhari007.

Include a description, the impact, steps to reproduce and any suggested fix. You'll get an acknowledgement within 72 hours and an initial assessment within 7 days. Reporters are credited unless they'd rather stay anonymous.

• Entitlement bypass: ways to unlock paid features without a valid RevenueCat entitlement
• Key exposure: secret (non-public) RevenueCat or store keys committed to the app
• Local data: quest data stored insecurely on the device

• Never commit secrets: use .env files (git-ignored) or GitHub Actions secrets
• Keep real personal data out of code, tests, issues and screenshots
• Treat all user input, and anything passed to an AI model, as untrusted