Do not open a public issue for a vulnerability. Email vulnerability-disclosures@expo.dev, Expo's disclosure contact (https://expo.dev/.well-known/security.txt), and say that the report concerns Exact.

Include the host (web, macOS, iOS, Linux, Android, Windows or the terminal), the commit of your checkout, how to reproduce it, and what an attacker gains. A minimal app that demonstrates it is better than a description.

Known problems, including open security ones with their severity, are recorded in issues/. A report that adds to one of them is still welcome.

Exact has no releases yet: a fix lands on main, and the issue that recorded the problem is closed with it.