Use private vulnerability reporting for sensitive website findings. Include the affected URL or commit, observed behavior and a safe reproduction. Do not put credentials or private captures in public issues.

This application serves public static content. It accepts no submissions, stores no visitor data and has no privileged application API. The organization links to other projects, which maintain their own security policies.

Dependency proposals require review and checks. Do not run production stress tests or send findings to others without authorization.