If you find a security vulnerability, please do not open a public issue. Report it privately through GitHub’s “Report a vulnerability” form on the Security tab, or by email to ninilich@tuta.io.
Include a description, steps to reproduce, and the affected version. You can expect an initial response within a few days.
Areas of particular interest: the local HTTP API (CLIAPIServer, loopback only), file handling of recordings, and the sandbox entitlements.