Security fixes are applied to the latest revision of the default branch.

Do not open a public issue for a suspected vulnerability or exposed credential. Use the repository's Security → Report a vulnerability private reporting form. Include affected paths, reproduction steps, impact, and any suggested mitigation. Maintainers should acknowledge a report within seven days and coordinate disclosure after a fix is available.

Never include real event photos, selfies, access tokens, or personal contact information in a report. Use synthetic test data.

This project processes biometric representations and personal contact data. Operators are responsible for access controls, HTTPS, backups, retention settings, consent language, incident response, and compliance with applicable law.