Report privately. Fix deliberately.
Effective date: October 20, 2026. We welcome good-faith security research affecting Last Refuge projects or this site.
How to report
Use the Contact page and include “Security report” in the subject, a clear description, reproduction steps, impact, and any suggested mitigation. Please do not publish details until we have had a reasonable opportunity to investigate and coordinate a fix.
Aerie and Google Drive
Aerie uses browser-based Google OAuth with PKCE, stores refresh tokens in the system keyring, and connects directly to Google over HTTPS. Its metadata cache and downloaded or synchronized files are stored on your device. Read-only access is requested first; changes and two-way sync require additional Google permission. See our Privacy Policy for the permissions, data use, retention, and sign-out behavior.
Security reports about Aerie may include Drive permission handling, local token storage, file operations, or synchronization. Use fictional filenames and sanitized logs in a report; do not send OAuth credentials, tokens, or private Drive contents. Aerie is in early development.
Safe harbor
We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us a reasonable opportunity to remediate. Do not access data that is not yours, degrade availability, or use social engineering.
Updates
Supported-version and release information is published with each project. We may acknowledge reporters where appropriate and with permission.