All still a work in progress

If (when!) you find an issue, how you report it depends on what it is.

Anything exploitable against a running instance — auth bypass, privilege escalation, data exposure, injection, and so on — please report privately through GitHub's private vulnerability reporting:

https://github.com/jpmorby/taskman/security/advisories/new

That keeps the details between us until there's a fix to ship.

For anything else — hardening suggestions, dependency warnings, or a security question that doesn't hand anyone a working attack — please raise a ticket / report through issues.