Please do not open a public issue for a security or privacy problem.

Email hello@kamsiob.com with "Meedwell security" in the subject line. Include what you found, how to reproduce it, and what you think the impact is. If you would like a reply encrypted, say so and include your public key.

Meedwell is maintained by one person, so a formal response window would be a promise this project cannot keep. What can be promised: your report will be read, you will get an acknowledgement when it is, and you will be told what is being done about it.

If a fix is needed, it ships as its own release with the security problem described in the release notes in plain language once users have had a chance to update. You will be credited unless you would rather not be.

Anything that could expose a user's Bandcamp credentials, since those are the only genuinely sensitive thing the app holds. Anything that sends data off the device that the app claims it does not send, because the privacy claims are the product and an inconsistency there is a real defect. Anything that lets another app on the phone read Meedwell's database or preferences. Anything in the download or import paths that could be used to write files outside the intended locations.

Bandcamp's own service and API. Report those to Bandcamp.

The absence of database encryption, which is a documented and deliberate decision recorded in DECISIONS.md: the database holds an album catalog and a play history, and keeping it as plain portable SQLite is what lets a user move their data to another device or a future desktop version. Credentials are the exception and are stored in Android's encrypted preferences, never in the database and never in an export.

Reports generated by an automated scanner with no demonstrated impact.