Open a GitHub security advisory (Security → Report a vulnerability) rather than a public issue, for anything that would let someone:

• get the tracker to read, write or send a file outside its own data directory
• turn something the tracker reads — an item name off the screen, a line in events.jsonl, a config value — into code that runs, markup in the stats page, or a request to somewhere it should not go
• make the tracker contact a host other than the GitHub releases API and a Discord webhook the player configured themselves

Anything else is fine as a normal issue.

These are design consequences, not bugs, and are documented in docs/INTEGRITY.md:

• The log is a local file. Its owner can rewrite it end to end and it will still verify. The hash chain detects damage and casual edits, not its own author.
• Item names come from OCR of whatever is on screen. They are escaped wherever they are displayed, but they are untrusted text, and any new surface that shows them has to treat them that way.

• Proof screenshots are crops of your own screen. The crop is the loot window, but an overlay drawn on top of the game can land inside it. Check one before attaching it to an issue.
• report.html is safe to send on, and it is worth knowing what goes with it: your pirate names, your drops, and the full path of your data directory, which usually contains your Windows username. The screenshots do not follow — they are links to files on your disk.
• debug/ frames are full captures of the game window, written only while save_debug_frames is on. Look at them before sharing.