Super Productivity is a free open-source task management app, available on both mobile and desktop. It has 50k+ users on Android and a 4.8 star rating on Google Play. SuperSync is an open-source end-to-end encrypted (E2EE) backup service for Super Productivity.
SuperSync had a protocol issue where the full contents of the user's task data were uploaded to the SuperSync servers before encryption was set up. If the user continued the remaining setup, by setting their password, then the plaintext contents would be deleted and replaced with the E2EE data. However, if the user abandoned the setup, their plaintext data could remain in the SuperSync database indefinitely. In E2EE protocols, sensitive data should never leave the user's device in plaintext, and the users of Super Productivity were given false assurances about this during the setup flow.
As this behaviour was live in production, I contacted the maintainer via a private GitHub Security Advisory in accordance with standard coordinated disclosure practices. The maintainer agreed that this was an issue, provided a fix, and made the advisory public once the fix was shipped.
The full details of the issue can be found here: https://github.com/super-productivity/super-productivity/security/advisories/GHSA-9v8x-68pf-p5x7