If you discover a security vulnerability in Decluttr, please do not open a public issue.

Instead, report it privately by emailing security@getdecluttr.app or using GitHub's private vulnerability reporting.

The following are in scope:

• The browser extension code (apps/extension/)
• The shared packages (packages/)
• Any data handling, storage, or permission usage

The following are out of scope:

• The marketing landing page (apps/landing/)
• Third-party dependencies (report those upstream)

• Description of the vulnerability
• Steps to reproduce
• Impact assessment (what can an attacker do?)
• Suggested fix (if you have one)

We will acknowledge your report within 48 hours and aim to release a fix within 7 days for critical issues.