Security fixes are applied to the latest revision on the default branch. Tagged release support will be documented when releases exist.

Please use GitHub's private vulnerability reporting feature for this repository. Do not open a public issue with exploit details, secrets, or personal data. Include affected revision, reproduction steps, impact, and any suggested mitigation.

Allow maintainers reasonable time to confirm and address the report before public disclosure.

The included nginx configuration serves plain HTTP. Production operators must provide HTTPS/TLS termination and configure PUBLIC_ORIGIN to the exact public HTTPS origin. Rotate AUTH_SECRET if exposure is suspected.