# Security

Please report vulnerabilities privately through GitHub's
[Report a vulnerability](https://github.com/dodert/accounts-balance-tracker/security/advisories/new)
form rather than in a public issue.

The app holds financial data. Turn the login on (`AUTH_USERNAME` / `AUTH_PASSWORD`, optionally
`AUTH_TOTP`), and run it on your local network or behind a reverse proxy with HTTPS.