Fabula is a pure client-side app: no server, no accounts, no analytics. The main things worth protecting are the fidelity of the files it writes back, the API key a user may store in their own browser, and the integrity of the published static bundle.

Email rogerawong@gmail.com with a description of the issue and, if you can, steps to reproduce. Please don't open a public issue for anything you believe is exploitable before it has been addressed.

This is a personal open-source project maintained by one person, so there is no security team and no guaranteed timeline — but reports are read and taken seriously.