Element Mods rewrites a local Element install and runs third-party JavaScript inside it, so please treat patches like any code you install.

If you find a vulnerability (for example a patch leaking messages or keys), please report it privately through GitHub's security advisories rather than a public issue.