Please report vulnerabilities through the repository’s private GitHub Security Advisory workflow rather than a public issue. Include the affected revision, reproduction steps, impact, and any suggested mitigation.

Faces stores learning progress locally in the browser and does not require accounts or transmit learner data. Do not include real personal data or secrets in a report.