Please report suspected vulnerabilities privately to the repository owner. Do not open a public issue containing credentials, tokens, personal data, or exploit details.

Include the affected endpoint or component, reproduction steps, impact, and any suggested mitigation. Revoke exposed credentials before sharing a report.

• Never commit appsettings.json, appsettings.Development.json, .env, database passwords, JWT keys, or refresh tokens.
• Use environment variables or a managed secret store in deployed environments.
• Use a unique JWT signing key with at least 32 bytes of entropy.
• Do not enable the development admin seed in production.
• Rotate a secret immediately if it may have entered Git history; deleting it from the latest commit is not sufficient.

Security fixes are applied to the latest version on the default branch.