Report a vulnerability in the BetterOff CLI, API, or OAuth flow to security@betteroff.finance. Do not open a public issue for a vulnerability.

Include the affected command or file, steps to reproduce, and the impact you observed. Use a synthetic or your own account; do not access other people's data. Never include API tokens or financial records in a report.

BetterOff's vulnerability reporting policy covers scope, response, and acknowledgments. The same contact is published in security.txt.

This repository contains the read-only command line client. It contains no server code or credentials. Server, OAuth, and API reports go to the same address.