# Security

DataLoom is designed to process Bitwarden exports locally and offline.

Bitwarden exports may contain passwords, TOTP secrets, secure notes, credit-card data, identities, custom fields, and other highly sensitive information.

## Important rules

- Never upload real Bitwarden exports to public repositories, issue trackers, chat systems, or third-party services.
- Never commit real exports, merged vault files, audit logs, screenshots, crash dumps, or backups to this repository.
- Use copies of exports for testing.
- Review generated output and audit-log locations carefully.
- Treat full-secret audit logs as equivalent to unencrypted password-vault files.
- Delete or securely protect generated files when they are no longer required.
- Use the synthetic fixtures in `tests/fixtures/` for development and testing.

DataLoom does not encrypt imported files, exported files, or audit logs. Users are responsible for protecting all sensitive files created or processed by the application.

## Reporting a security issue

Please do not include real vault exports, passwords, tokens, or other secrets in a bug report. Describe the issue using synthetic data whenever possible. For sensitive reports, contact the repository maintainer privately rather than opening a public issue.

## Scope

This document describes safe handling of data processed by DataLoom. It is not a guarantee that the software is secure or suitable for production use. Review the disclaimer in `README.md` before using the application.