Please report suspected vulnerabilities privately via GitHub private vulnerability reporting

• do not open a public issue for security problems.

You can expect an acknowledgment within a few days. Please include steps to reproduce and the potential impact.

What is enabled and why - plus the audit behind it - is documented in docs/SECURITY-POSTURE.md.

This is a portfolio application with no authentication, no user accounts, and no sensitive data: the database contains only public lottery results, and the repository is designed to contain zero secrets (see the main README). Reports about dependency vulnerabilities are usually already covered by Dependabot alerts and CodeQL, but reports of flaws in the application code itself are welcome.

Only the latest commit on main is supported.