Please do not open a public issue for security vulnerabilities. Instead, report them privately via GitHub Security Advisories.

We will acknowledge reports as promptly as we can and work with you on disclosure timing.

pushwork synchronizes directory contents through a sync server. Keep in mind:

• File contents are not end-to-end encrypted by pushwork itself; anyone with the automerge: root URL can clone the tree from the sync server. Treat root URLs as capabilities and share them accordingly.
• Deleted files are removed from the folder document but the underlying document history remains on the server (there is currently no garbage collection or history purge).
• Transport security depends on the sync server deployment (use wss://).