Only the latest release and the main branch get security fixes.

Please don't open a public issue for security problems.

Use GitHub's private reporting instead: go to the repository's Security tab and click Report a vulnerability. Include what you found, how to reproduce it and what an attacker could do with it.

You'll get a reply within a week. Once a fix is ready it ships in a release, and you're credited in the advisory unless you'd rather stay anonymous.

GymBro stores everything on the device and has no server or account system. The most relevant areas are the local database, imported files (CSV, backups, AI plans), shared images and the Strava export.