Please report suspected vulnerabilities privately through the DrawSplat contact form or by email to drawsplat@gmail.com. Include the affected URL or component, reproduction steps, impact, and any proof-of-concept material needed to confirm the issue.

Please do not include real student data, disrupt production services, access another person's data, or publish an unpatched vulnerability. DrawSplat aims to acknowledge actionable reports promptly, coordinate remediation and disclosure with the reporter, and credit responsible disclosure when requested.

The canonical machine-readable contact is /.well-known/security.txt. DrawSplat does not currently publish a PGP reporting key, operate a paid bug-bounty program, hold SOC 2 certification, or claim an independent security audit. CipherSplat separately supports user-supplied OpenPGP keys for local file and text operations.

CipherSplat is a static, local-only browser application. Reports about its package parser, cryptographic construction, path validation, password handling, offline bundle, Content Security Policy, or misleading security claims are in scope.

CipherSplat uses no backend, account, remote storage mode, telemetry, analytics, advertising, or upload API. Its security model does not extend to a compromised operating system, browser, extension, device administrator, keylogger, screen recorder, or malicious replacement of files in a downloaded offline copy.

Security fixes are applied to the current main branch and the current production deployment at drawsplat.org. Self-hosters and users of downloaded copies are responsible for updating to a fixed release.