Soma's reader runs entirely on the learner's device and the packs are plain JSON, so the main security-relevant areas are:

• injection of malicious content through a pack (the reader renders pack strings as text, never as HTML, and the validator restricts graphemes)
• the offline build pipeline and the CLI (path handling, served directories)
• the service worker and local storage behavior

If you find a vulnerability, please report it privately to mdanielseo@gmail.com rather than opening a public issue. Include:

1. A short description of the issue
2. Steps to reproduce
3. Affected versions (v0.1.x) and component (reader / cli / core / pack format)

You will receive an acknowledgement within 7 days and a status update within 30 days. We ask for coordinated disclosure: wait for a fix release before publishing details.

• Content mistakes inside contributed packs (report those as normal issues)
• Deployment-specific concerns of third parties who host the reader