Everything in this repository is intended to be public:

• organizations and people are fictional;
• contact domains end in .example;
• payment methods contain obvious tok_cindercone_synthetic_#### tokens only;
• there are no PANs, card fragments, expiry values, bank details, routing values, tax IDs, credentials, production tenant URLs, or customer data;
• fixture OAuth values are fixed local policy markers, not secrets.

build.py rejects non-.example email addresses, sensitive field names, non-synthetic token formats, PAN-like strings, binary floating values, unsafe integers, cycles, and non-JSON values before installation.

• No backend, service worker, telemetry, analytics, cookies, local storage, remote font, remote image, or third-party script.
• A restrictive CSP allows only same-origin scripts, styles, images, and fetches.
• UI data is inserted with DOM text nodes and textContent; generated values are not interpreted as HTML.
• Dialogs have explicit names, ancestor-aware visible-control focus containment, and opener focus restoration.
• Unsaved account exits use an accessible Save/Discard/Cancel dialog for close buttons, native Escape/cancel, and history navigation; no window.confirm prompt is used.
• Static hosting cannot process mutations. Runtime controls exist only in the imported browser/Node module.

The runtime rejects prototype-bearing objects, accessors, non-enumerable data, symbols, sparse arrays, recursive objects, nonfinite values, unsafe integers, duplicate JSON keys, malformed dates, encoded traversal, URL credentials/fragments, unknown or undeclared resource/action fields, wrong action field types, stale concurrency tokens, and overapplication.

Mutation work occurs on a clone and commits atomically. Cumulative usage and invoice calculations use checked BigInt intermediates. Replay requires and verifies a canonical tape hash before execution, and fixture tokens expire when the virtual clock reaches their exact boundary. Deterministic idempotency and ABA-safe ETags address the concurrency cases represented by this single-process simulator. They are not production distributed-locking controls.

Do not include real credentials, customer data, or exploit payloads in a public issue. Use GitHub's private vulnerability reporting channel when available. Include:

1. affected commit and file;
2. minimal synthetic reproduction;
3. expected and observed behavior;
4. impact within this static simulator's documented boundary.

The maintainers will assess reports against the latest main branch. This educational project does not provide a production-service SLA.

“Zuora” appears factually to name the compatibility target. The project contains no Zuora logo, color system, screenshots, CSS, fonts, copied documentation, or copied OpenAPI content. Please report accidental third-party material as a provenance issue.