Please report suspected vulnerabilities privately to the support address shown in Prepora. Include the affected route, impact, and a minimal reproduction. Do not include live credentials or private user data.

Production credentials must be stored in the deployment provider's encrypted secret manager. Service-account JSON files must never be committed or retained inside the application directory.