If you believe you have found a security vulnerability in this repository, please do not open a public GitHub issue.

Instead, report it privately using GitHub's private vulnerability reporting feature on this repository, or email the maintainers directly.

Please include:

• A description of the issue and the potential impact.
• Steps to reproduce (a minimal proof-of-concept is ideal).
• The version / commit SHA you tested against.
• Any suggested mitigation, if you have one.

We aim to acknowledge reports within 3 business days and to provide a fix or mitigation plan within 30 days of confirmation, depending on severity.

This project is a demo / reference application. It:

• Calls the public Azure Retail Prices API — no credentials required.
• Does not store user data or persist calculations.
• Ships with default Aspire dashboard authentication for local development.

Reports about the following are in scope:

• Remote code execution, SSRF, or injection vulnerabilities in the API or Web services.
• Dependency vulnerabilities we have not yet upgraded past.
• Template YAML parsing or NCalc expression evaluation issues that could lead to code execution or DoS.

Out of scope:

• Missing security headers on the local Aspire dashboard.
• Findings that require a compromised local developer machine.
• Third-party services referenced from templates or docs.

Only the main branch is actively maintained. Please test against the latest commit before reporting.