Please do not report security vulnerabilities in public GitHub issues.

Use GitHub's private vulnerability reporting feature for this repository. If it is unavailable, contact the repository owner privately through the contact method listed on the GitHub profile.

Include:

• affected app version and Nextcloud version;
• a clear impact description;
• reproducible steps or a minimal proof of concept;
• any suggested remediation, if available.

Please allow reasonable time for assessment and a fix before public disclosure.

Security fixes target the latest release on the default branch and the supported Nextcloud version range declared in appinfo/info.xml.