Please do not open a public GitHub issue for security vulnerabilities.

Report privately by emailing nagizaazs@gmail.com with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

You will receive an acknowledgment within 48 hours. If confirmed, a patch will be released promptly.

When deploying this project:

• Never commit real API keys or secrets to version control
• Use .env files (excluded from git) for local development
• Use GitHub Secrets or a dedicated secrets manager in production
• Keep all dependencies up to date — run pip install --upgrade -r requirements.txt regularly
• Enable Dependabot alerts on your fork

The following are in scope for security reports:

• Authentication or authorization bypass
• Remote code execution
• SQL/command injection
• Sensitive data exposure
• Denial of service vulnerabilities

Responsible disclosures will be credited here (with your permission).