Please do not open public issues for security problems.

Report vulnerabilities privately through GitHub's "Report a vulnerability" button (Security → Advisories) or by email to contact@thealchemistcode.org. Include steps to reproduce and the affected page or file. We aim to acknowledge reports within 72 hours.

Especially relevant areas: the contact form (inc/contact.php), output escaping in inc/views, and anything that could expose server or deploy details.

En español: reporta los problemas de seguridad en privado, con el botón "Report a vulnerability" de GitHub o por correo a contact@thealchemistcode.org. No abras un issue público.