REPORT PRIVATELY
Security
Last updated: 2026-11-02
If you believe you have found a security issue, please report it privately using one of the email addresses in security.txt. Do not post exploit details in public issues or discussions before a fix is available.
What to include
Share the affected URL or repository, the security impact you observed, and clear reproduction steps. Include supporting screenshots or a proof of concept only when necessary. Do not include real user data, passwords, or access tokens.
Good-faith security research is welcome. Spam, social engineering, and denial-of-service testing are out of scope. Please avoid actions that access, alter, or disrupt other people's data or services.
What happens next
We will review and acknowledge a report, work on a fix where appropriate, and credit you if you wish. Please tell us how you would like to be credited. We do not promise a response or resolution time.
How this site is protected
- The site is made of static files served by GitHub Pages.
- A restrictive Content-Security-Policy is set with a meta element.
- The site’s primary fonts and functionality scripts are self-hosted. The Google Analytics loader is external and delayed until after page load.
- Repository README HTML is sanitized with DOMPurify before it is displayed.
- GitHub Pages serves the site over HTTPS.
- Google Analytics 4 is used with Google signals and ad personalization disabled; see the Privacy Policy.