Please do not open a public GitHub issue for security vulnerabilities.

Report privately using one of:

1. GitHub Security Advisories (preferred) — confidential, works for collaborators and external reporters.
2. Maintainer contact — if Advisories are unavailable, email or DM the repo owner via GitHub profile contact methods.

Include:

• Description of the issue and impact
• Steps to reproduce
• Affected versions or commits
• Suggested fix (if any)

• Acknowledgment: within 7 days
• Triage: severity assessment and planned fix timeline
• Disclosure: coordinated after a fix is available (credit given unless you prefer anonymity)

Customize this section for your project after bootstrap.

In scope (examples):

• Application server/API and authentication flows
• Container images and CI-supplied artifacts
• Dependency vulnerabilities surfaced by CI security scans

Out of scope (examples):

• Issues requiring physical access to the host machine
• Social engineering
• Denial-of-service against a single-user local instance (unless exploitable remotely)

We support good-faith security research on this repository. Do not access data outside your own systems or exfiltrate user data when testing.