• No privileged API keys, access tokens, admin secrets, or payment secrets may be shipped in this repository's Pages artifact.
• Production API traffic is allowed only to the same origin or https://api.jantrack.ajaynxt.com.
• Citizen evidence images are re-encoded before upload to remove EXIF/GPS metadata; offline queue records do not persist the image payload.
• User-provided strings must be HTML-escaped before any template insertion. User-controlled URLs must pass the URL allowlist helpers in js/security.js.
• The service worker may cache only the explicit static runtime allowlist. API responses and cross-origin resources must never be cached by the service worker.

• Keep Actions permissions at least privilege.
• Keep third-party/GitHub Actions pinned to full commit SHAs.
• Enable branch protection for main, required status checks, secret scanning/push protection where available, and Dependabot/security updates.
• Do not use pull_request_target to execute untrusted pull-request code.

GitHub Pages is suitable for the static frontend. For the production API, authentication, uploads, moderation and admin functions, use a backend that can set response security headers including Content-Security-Policy with frame-ancestors, HSTS, Permissions-Policy and other server-side controls.