thencloud's promise is that the server never sees your keys, passwords, file names or file contents. If you find a way to break that, or any other vulnerability, please tell us privately.

Use GitHub's private vulnerability reporting. Please include:

• what an attacker can do, and from where (a malicious server, another user, someone with a public link, a web page);
• steps or a proof of concept;
• the commit you tested.

Please don't open a public issue, and give us a reasonable time to fix it before you publish. We'll reply within a week.

In scope, for example:

• anything that lets the server, or anyone else, learn plaintext names, contents, keys or passwords;
• a malicious server swapping, reordering or truncating ciphertext without the client noticing;
• a shared file or public link that runs script in the app's origin;
• authorisation bypasses (reaching nodes you don't own and weren't shared).

Known limitations are listed under "Threat model" in the README and aren't vulnerabilities in themselves, for example that the web client is served by the server, or that the opt-in video downloader sees the videos it fetches.

Fixes go to main and into a release of the latest 1.x line. Older releases don't get backports, so please update to the newest one.