Use the repository's Security tab to submit a private vulnerability report. Do not disclose suspected vulnerabilities in a public issue.

Include the affected version, reproduction steps, expected impact, and any suggested mitigation. You should receive an acknowledgement within seven days.

This project is a local portfolio service. Authentication, authorization, production deployment, backups, and operational alerting are intentionally outside the current repository scope and are documented in the README.