The main branch is the active development line.

Please report security issues privately through GitHub Security Advisories.

Do not open public issues for authentication, authorization, account, payment, or data exposure vulnerabilities.

Current foundations include:

• JWT-ready backend architecture.
• Permissive development defaults only where explicitly documented.
• Environment examples with no production secrets.
• Public content only in starter lesson data.

Future security work includes rate limiting, role-based authorization, content moderation workflows, and audit trails for admin actions.