Please do not report security vulnerabilities in public issues. Send a private report to the project maintainer through the repository's private contact method or GitHub's private vulnerability-reporting feature when enabled.

Include a clear description, affected version or commit, reproduction steps, impact, and any proof of concept that can be shared safely. We will acknowledge reports, assess the issue, and coordinate disclosure after a fix or mitigation is available.

Do not include API keys, invitation secrets, personal data, or live service credentials in a report. The project currently relies on browser-delivered assets and third-party map, signalling, and data services; reports involving those services should also follow the provider's security policy.