Clausery is a client-side application: there is no server that stores customer data. Security issues that matter are therefore in the browser code (template parsing, expression evaluation, encryption at rest, license verification, content security policy) and in the build pipeline.

Report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability (direct link). Include a description and, if possible, a minimal reproduction. Please do not open a public issue for a vulnerability. We aim to acknowledge reports within two business days and to publish a fix and a changelog entry as soon as one is available. Please do not test against deployments you do not control.

• The application under clausery/app, clausery/src, clausery/sw.js and the generated site pages
• The vendored document engine build (clausery/tools/build-vendor.mjs)
• The license tooling (clausery/tools/license.mjs)

• No eval or Function; expressions are interpreted by app/lib/expr.js
• No inline or third-party scripts; CSP default-src 'self'
• Encryption at rest: AES-256-GCM, PBKDF2-SHA256 (600k iterations), WebCrypto only
• Licenses: Ed25519 signatures verified with an embedded public key
• Dependencies are pinned and bundled into the repository; runtime has no CDN dependencies