Please report it privately through GitHub: Security → Report a vulnerability on this repository. Do not open a public issue for it. You will get an answer within a few days.

• A service key or a password is read when a download starts and kept in memory only. It is never written to the settings, the log or the report.
• Log lines pass through a filter that removes bearer tokens, client secrets and passwords before they reach the file.
• Only HTTP GET requests are sent to the tenant; the app cannot modify it.
• Updates are downloaded only from this repository's releases and installed only when their SHA-256 matches the checksum published with the release.