Report a vulnerability through GitHub private vulnerability reporting: open the Security tab of this repository and choose "Report a vulnerability". Please do not open a public issue for anything exploitable. The app has no backend, no accounts and no network calls after the first load, so the realistic surface is small, but reports are still welcome and will be answered.