This is a static educational site. There is no server, no accounts, and no custody of funds. Still, some things matter:

• Anything that could execute attacker-controlled script on the site (XSS through content or dependencies).
• A compromised or malicious dependency.
• Content that could trick a reader into an unsafe action (for example, a doctored "verification" step or a wrong download instruction).

To report: use GitHub's private reporting ("Report a vulnerability" under the Security tab) or email harry@hotpixelgroup.com. Please do not open a public issue for anything exploitable.

Factual errors in the educational content are not security issues; report those as a regular content error issue.