Security fixes are applied to the latest release.

Please use GitHub private vulnerability reporting. Do not open a public issue containing an undisclosed vulnerability or sensitive diagram data.

Include the affected browser, a minimal reproduction, and the expected impact. You should receive an acknowledgement within seven days.

Flowchart Creator runs entirely in the browser. It does not send diagram content to a remote service. Saved projects use the browser's local storage; downloaded project and image files are handled by the browser.