Use GitHub's private vulnerability reporting on this repository (Security tab, "Report a vulnerability"). Please do not open a public issue for a security problem.

Never include personal financial data in a report: no statements, confirmations, account identifiers, balances or real holdings. Describe the problem with synthetic data.

None yet. keel is pre-alpha; once v0.1.0 ships, the latest minor release receives fixes.

Anything that could expose a user's data folder, send data off the machine without the user enabling a connector, or let a crafted terms file or document execute code or exhaust resources.