Please report security issues privately through GitHub:

https://github.com/reincore/matchboxd/security/advisories/new

Do not open public issues for suspected vulnerabilities. Include the affected URL or code path, reproduction steps, impact, and any relevant logs or screenshots. We will review valid reports and coordinate fixes through the private advisory thread.