Report vulnerabilities privately via GitHub's Security Advisory https://github.com/vectojs/webos/security/advisories/new. Do not open a public issue. We respond within 72 hours and publish fixes in a patch release.

The latest release on the main branch is the only supported version.

This is a client-side demo — no user data leaves the browser. Supply-chain risk is limited to the pinned @vectojs/* dependencies and the Cloudflare Pages hosting.