Do not disclose vulnerabilities, databases, passwords, cookies, CSRF values or private exercises in public issues. Contact Jason Stys on LinkedIn for a private reporting channel, then share a minimal synthetic reproducer. Do not attach a real account token to your initial message.

The supported scope is the current main branch used as a loopback-bound, trusted single-workspace synthetic application. This is not a hardened public authentication provider, multi-tenant SaaS, operational emergency service or certified aviation software. No blanket security or response-time guarantee is made. See threat model and recovery.