POELIO is a public teaching research preview, not a production-security-certified service. The website is deployed on GitHub Pages from CI-validated main commits. The maintained software baseline is the latest commit on main; an archived build or earlier release candidate is not automatically patched.
The application uses no accounts, backend participant store, AI inference endpoint, or analytics integration. Public creative drafts live in per-tab browser session storage, with a memory-only fallback; session storage is not encrypted or guaranteed erased. Review notes are memory-only.
Please do not publish exploit details, private content, tokens, or personal information in a public issue. Use GitHub's private vulnerability reporting / repository security page if the maintainer has enabled that feature. If private reporting is not available, contact the maintainer privately through a preexisting verified channel before sharing a reproducible disclosure.
A useful report includes the affected commit, clear reproduction steps with synthetic data, observed impact, and an expected safety boundary. Never attach unpublished La Relève manuscripts or real participant records.
- Locked dependency installation and vulnerability audits, including development tools.
- SHA-pinned software source fixtures and fail-closed public static-asset inventory.
- Tests for unexpected network transmission, inappropriate browser persistence, shared-device handoff, and offline cache boundaries.
- Exact-byte release evidence and prospective hosted-header contract checks.
- Desktop/mobile browser regression suites.
These are engineering checks, not an independent penetration test. GitHub Pages cannot supply project-specific HTTP response headers required by the stricter host contract in docs/HOSTING_RESPONSE_HEADERS.md. Manual assistive-technology and independent accessibility acceptance remain outstanding before broader institutional use.
See security and privacy acceptance and host security requirements.