The GlycoStep maintainers take security and data privacy seriously. Because GlycoStep utilizes local-first storage and interacts directly with Apple HealthKit and hardware motion coprocessors, protecting user privacy is paramount.

If you discover a security vulnerability or sensitive data leak, please report it responsibly:

1. Do not open a public GitHub issue.
2. Email the maintainers directly at security@buildingcoolstuff.com (or create a private GitHub Security Advisory).
3. Include detailed steps to reproduce the vulnerability, including device model, iOS version, and relevant logs.

• Acknowledgment: Within 48 hours.
• Assessment & Patch: Critical vulnerabilities will be prioritized and patched within 7 business days.
• Public Disclosure: Coordinated after the fix has been merged and released.

Thank you for helping keep GlycoStep safe and private!