Please do not disclose vulnerabilities in a public issue. Report them privately to the repository owner through the contact details on the live site or GitHub profile.

Do not send credentials, API keys, or other secrets in reports. The contact endpoint intentionally accepts only name, email, and message fields, uses a fixed recipient, validates input on the server, and applies a lightweight per-instance request limiter.