OptPrep runs in your browser and stores progress on your device. The optional sync talks only to api.github.com with a token you create.
To report a vulnerability, open a private security advisory. Please do not open a public issue. I aim to reply within a week.
Never paste a GitHub token, passphrase or backup file into an issue.