Breakscale runs entirely in the browser. It has no backend, no accounts, and sends no data anywhere; a saved design lives in your own browser storage or in a link you choose to share.

That limits the blast radius of most issues, but not all of them. If you find something that could harm a user, for example a crafted share link that executes script when opened, please report it privately rather than opening a public issue.

Use GitHub's private vulnerability reporting on this repository. You should get a response within a week.

Please do not report findings from automated scanners without checking they are real and reachable in this application.