Please report vulnerabilities privately through GitHub: Security → Report a vulnerability on this repository. Do not open a public issue.

Relevant areas: handling of the CalDAV password and config files, the daemon's network access, and anything that could make restask delete or overwrite notes or server tasks unexpectedly.

restask is maintained on a best-effort basis; expect an acknowledgement within a few days.