Do not open a public issue for a security problem.

Report it privately through GitHub:

1. Go to Report a vulnerability.
2. Write what the problem is, the steps to show it, and the effect.
3. Send the report.

You get an answer within 7 days. When the fix is live, the advisory is made public and you get credit, if you want it.

• The code in this repository.
• The hosted app at the address in NEXT_PUBLIC_APP_URL of the official deployment.

Out of scope: problems in GitHub, Supabase, Groq, Google Gemini or Vercel. Report those to the service.

Only the latest commit on main gets security fixes.