Please do not report security vulnerabilities in a public issue.

Use GitHub's private vulnerability reporting when it is available for this repository. If private reporting is unavailable, contact the repository owner privately through an appropriate GitHub channel and include enough information to reproduce the problem without sending personal music files or other sensitive data.

Examples include:

• unsafe file writes or path handling
• backup or restore behavior that can unexpectedly overwrite data
• synchronization-plan validation bypasses
• accidental exposure of credentials or sensitive local paths
• dependency or packaging problems with a meaningful security impact

Please avoid publicly posting exploit details until the issue has been reviewed and a fix or mitigation is available.

Harmelune operates on local music libraries. A security report should explain the affected version or commit, the relevant operating system, and the smallest reproducible scenario when possible.