Report vulnerabilities in Desktop Accounting API, its SDKs or its examples privately. Do not open a public issue.

• Use GitHub's Report a vulnerability button on the affected repository's Security tab, or
• contact us through https://www.desktopaccountingapi.com/contact and ask for a private security channel. Do not include exploit details in the first message.

Include the affected repository and version, a description of the impact, and steps to reproduce. Never include real secret keys, webhook signing secrets, Web Connector passwords or customer data. Use test credentials or redact them.

If a secret key (sk_live_... or sk_test_...) may have been exposed, revoke it in the dashboard immediately. Keys can be revoked and replaced at any time.