The current supported version is the code on the default branch and the production deployment at:

https://flowermoji.netlify.app/

Do not open a public issue for secrets, account access problems, private user data, or exploitable vulnerabilities.

Preferred reporting path:

1. Use GitHub private vulnerability reporting if it is enabled for this repository.
2. If it is not enabled, contact the maintainer through the GitHub profile for this repository.

Please include:

• A short description of the issue.
• Steps to reproduce.
• Affected files or URLs.
• Whether the issue affects production, local development, or both.

In scope:

• Gift creation and reading through netlify/functions/gifts.js.
• Input validation and sanitization.
• PWA/service worker behavior.
• Public configuration handling.
• Accidental exposure of secrets in repository files.

Out of scope:

• Social engineering.
• Denial-of-service testing against production infrastructure.
• Testing LINE, Netlify, Pexels, or other third-party services without permission.

• Do not commit API keys, LINE channel secrets, access tokens, cookies, or private account data.
• Keep dependency audit output clean where practical.
• Verify public configuration values before changing repository visibility.