Please report vulnerabilities privately rather than opening a public issue.

The demo intentionally avoids authentication so reviewers can run it quickly. Before a real deployment, add organization-scoped authentication, server-side authorization, managed secrets, distributed rate limiting, audit retention controls, and database row-level tenancy boundaries.