Report vulnerabilities privately through GitHub Security Advisories. Do not include credentials, personal information, or exploit details in a public issue.

This static site requires no production secrets and accepts no user accounts or stored server data. Dependency updates are reviewed and CI verifies the production build.