Please do not open a public issue for security-sensitive reports.

Instead, contact the repository maintainers using GitHub private vulnerability reporting:

1. Open the repository on GitHub.
2. Select Security → Private vulnerability reporting (if enabled by the maintainer).
3. Or use repository contact links from the profile or README if provided.

Include:

• A short description of the issue and its impact
• Steps to reproduce (or proof-of-concept)
• Affected paths, versions, or deployment context if known

We aim to acknowledge valid reports promptly; resolution timelines depend on severity and workload.

Production deployments should additionally:

• Rotate database credentials and use least-privilege DB roles
• Restrict ALLOWED_ORIGINS to known front-end origins
• Run behind TLS termination and trusted reverse proxies
• Keep dependencies patched (npm audit, image rebuilds)

For local development defaults, refer to README.md and .env.example.