Do not open a public GitHub issue for security problems.

Please report responsibly:

1. Email is not preferred for sensitive detail if avoidable — open a private security advisory on this GitHub repository when available, or
2. Open a minimal public issue titled [SECURITY] request private channel without exploit details, and wait for maintainers to contact you.

Include:

• Affected URL or page (if website-related)
• Description of the issue
• Steps to reproduce (privately)
• Impact assessment (if known)

We aim to acknowledge reports within a few days.

• Third-party vendor APIs (e.g. TypeSafe / Jev) are out of scope for this project — report those to the vendor.
• Social-engineering or physical attacks are out of scope.
• Denial-of-service against shared hosting is out of scope unless caused by an application defect we control.

We prefer coordinated disclosure. Please give us reasonable time to investigate before public write-ups.