Report vulnerabilities privately to codeincommunity@gmail.com, with steps to reproduce, the affected component, and potential impact. Do not post secrets, personal data, or exploit details in public issues. This community project has volunteer maintenance; no response deadline is guaranteed.

The supported implementation is the current website and toolkit on main. legacy/website is an archival source collection and is not deployed as an executable website.

The GitHub tools use fixed, read-only public API endpoints. They do not execute repository content. Optional API tokens belong only in server or local CLI environments. The website does not accept private repositories. Template generation happens in the browser or CLI and should be reviewed before adoption. The readiness auditor reports file evidence and is not a security scan.