Please report privately through GitHub's security advisories rather than in the open, since a repository holds a medical record.

A .wits directory is health data: what was dispensed, when, and how much was used. It is created 0700 with its files 0600, is never transmitted anywhere, and the application makes no network calls at all.