Report vulnerabilities privately to the repository owner rather than through a public issue. Do not include real medical, account, or secret data in reports.

NutriValue is educational software and not a medical device. Production operators are responsible for legal review, provider licensing/attribution, privacy notices, accessibility, claim governance and regional nutrition-labelling requirements.

Never commit provider keys, AWS credentials, production addresses or decrypted Parameter Store values.