Please report it privately, by email to security@ascham.app. To encrypt it, use our OpenPGP key, public/security.asc, fingerprint 9351 0FD3 9C07 490B 0FC7 A9AF 91FF D6D9 3D2E FB02.

Include:

• what the problem is and what an attacker could do with it;
• the steps to show it, with a made-up text and made-up names;
• your browser and its version, and the page or commit you tested.

Never send pasted text from a real class, students' work, or any student data, and never send a licence key. If the problem only shows with a particular text, describe its shape (length, characters, layout) or write a made-up text that does the same.

Please give us a reasonable time to fix it before you publish. We will say in CHANGELOG.md when the fix is live, and credit you there if you want to be named.