Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately through GitHub's private vulnerability reporting on this repository. If that is unavailable, email alexis@sgarbossa.com.ar.

You can expect an acknowledgement within a few days. Please include the version (yz version), your OS and architecture, and steps to reproduce the issue.

• yz stores your Cloudflare R2 credentials in ~/.config/yz/config.json with 0600 permissions and refuses to load world-readable configs.
• The R2 API token you provide needs only Object Read & Write on your bucket. Use a scoped token, never your Cloudflare global API key.
• yz sends no usage telemetry. Sharing talks only to Cloudflare endpoints (OAuth, the Client v4 API, and your R2 S3 endpoint). A release check may contact GitHub at most once a day; set YZ_NO_UPDATE_CHECK=1 to turn that off. The cache for that check is ~/.config/yz/update.json, mode 0600.
• Public shares are public: anyone with the link can download the file until you delete it. Use --expires or --signed for sensitive files.