This project is a static web application + simple scripts. Latest main is supported. No formal version matrix.

Please open an issue with the security label describing:

• Affected area (webapp, service worker, data file, script)
• Steps to reproduce (if applicable)
• Potential impact (e.g., XSS, sensitive data exposure, broken access control)

Do not include exploit code that could harm users directly. Provide a minimal proof of concept.

If any credential (API key, token, private key, password) is discovered in this repository:

1. Revoke/rotate the secret immediately.
2. Remove it from the current codebase.
3. Remove it from git history before public release.
4. Document remediation in a security issue so collaborators understand what changed.

• No external third-party analytics scripts (privacy focus)
• Content Security (implicit) by avoiding inline event handlers; minimal inline script (SW registration only)
• Escape dynamic strings going into HTML (e.g., escapeHtml helper in clubs table)
• Service worker scoped to webapp/ directory; cache versioning to manage invalidation

• Extension-related console warnings not originating from code
• Issues caused by user-modified localStorage state

• Add explicit Content-Security-Policy meta (when hosting environment allows headers)
• Input validation / sanitization library if user-generated content added
• Integrity attributes for core scripts if CDN usage introduced