The current 1.x line receives fixes as maintainers are available. No response-time guarantee is offered.

Do not post API keys, authentication files, personal learning records or exploitable private details in public issues. If the repository offers GitHub private vulnerability reporting, use its Security tab to report privately. Otherwise open a minimal issue asking for a private reporting channel without including the sensitive details. Do not assume that a private reporting form has been enabled.

The bundled exporter reads one JSON file and writes one local TSV file. It does not execute card content or make network calls. Importing into Anki is a separate user action. Future network or tool capabilities must document their data flow and permissions.

scripts/scan_public.py catches common credential formats, personal absolute paths and unexpected email addresses. It is a defense-in-depth check, not proof that every possible secret is absent. Review staged changes and use repository/platform secret protection where available.