Please do not open public issues for security problems. Use the Security tab of this repo and click Report a vulnerability. We aim to reply within 72 hours.

In scope: SQL injection, unauthorized writes, upload handling (path traversal, unsafe file types), data that could mislead donors about where funds went, and denial of service against the indexer.