# Security

Breakscale runs entirely in the browser. It has no backend, no accounts, and sends no data
anywhere; a saved design lives in your own browser storage or in a link you choose to share.

That limits the blast radius of most issues, but not all of them. If you find something that could
harm a user, for example a crafted share link that executes script when opened, please report it
privately rather than opening a public issue.

Use GitHub's [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
on this repository. You should get a response within a week.

Please do not report findings from automated scanners without checking they are real and reachable
in this application.