Security & disclosure
Report a concern without exposing other people’s data.
Private reporting
Use the contact form with security report in the description to initiate contact. Include the affected route and a concise description without secrets, exploit payloads or sensitive evidence. A dedicated verified security email has not yet been configured; the operator must arrange a safe channel before sensitive details are exchanged.
Responsible scope
Do not access or modify another person’s records, disrupt service, perform denial-of-service testing or disclose private data. Stop once you have enough evidence to explain a suspected issue. No legal safe harbor or bounty is implied by this draft.
Implemented boundaries
Privileged APIs enforce server-side identity and an explicit administrative allowlist. User submissions enforce ownership. Browser writes require matching origins. Input sizes, URLs and rate limits are checked. Evaluation execution stays separate from the public web runtime.
Limits and operations
Automated tests and review reduce risk but are not a security certification. Production sign-in, role provisioning, delivery providers and backup operations must be verified in the deployed environment. Follow-up communications and response commitments require founder confirmation.