Please do not disclose credentials or exploitable vulnerabilities in a public issue. Use the repository's private vulnerability reporting channel when available. Otherwise contact the maintainer privately through the official account linked from the repository before sharing technical details.

A useful report includes the affected version, the smallest reproducible example, the expected boundary and the observed impact. Use synthetic accounts. Do not access another student's data, run load tests against the hosted service or create real payments to demonstrate an issue.

• Sessions use HttpOnly, SameSite cookies; passwords are hashed with Argon2id. State-changing requests are checked against the configured origin.
• Registration never accepts owner or Premium privileges. Paid APIs check entitlement on the server.
• Requests and authentication are rate-limited by IP and account identifiers. Tutor, voice and embedding operations have daily quotas and concurrency limits.
• Premium is coming soon. Checkout requires an explicit billing launch flag, valid Stripe configuration and Turnstile. The server validates the challenge, hostname, action, account binding and timestamp before contacting Stripe. It also verifies the USD 10 monthly price.
• Stripe webhooks require a valid signature and retrieve the current subscription state; a success redirect does not grant Premium.
• PostgreSQL isolates learner records and vector memories; embedding use requires consent. Do not point test suites at a real learner database.

These controls do not constitute an independent security audit or a promise that abuse is impossible. Operators must maintain their infrastructure, review provider usage and protect backups and secrets.

No publiques credenciales ni vulnerabilidades explotables en un issue público. Usa el canal privado de seguridad del repositorio cuando esté disponible; en caso contrario, contacta en privado con la cuenta oficial del mantenedor antes de compartir detalles.

Incluye versión, reproducción mínima e impacto, usando cuentas sintéticas. No accedas a datos de otros alumnos ni hagas pruebas de carga o pagos reales. Los controles descritos protegen sesiones, permisos, cuotas, memoria y pagos; no sustituyen una auditoría independiente ni el mantenimiento de la infraestructura.