Thermal Notes is a static, browser-only application. It has no backend, authentication system, remote print endpoint, telemetry, or hosted database.

Security reports are welcome for issues that could:

• transmit note contents or local files without clear user action;
• access a printer or another device without explicit permission;
• execute untrusted HTML or script from pasted/imported content;
• expose documents stored by the application to another origin;
• introduce a dependency or deployment path that sends private data away from the visitor's device.

Please do not open a public issue for a vulnerability that could put users at risk. Contact the maintainer privately through the contact information at saskyco.com and include reproduction steps, affected browsers, and the expected impact.

Do not include real private notes, credentials, or personal data in a report.

• Host the unchanged static files over HTTPS.
• Do not add analytics that capture editor contents.
• Do not add a remote print endpoint to the public deployment.
• Review third-party printer adapters before granting hardware permissions.
• Keep the embedded QR library's MIT attribution intact.