Only the latest version on the default branch is supported. Security+ Tracker is deployed straight from it, so a fix lands for everyone as soon as it is merged.

Security+ Tracker has no backend, no accounts and no analytics. It stores study progress in your browser's localStorage. Nothing you enter is sent to a server I run.

Please don't open a public issue for a security problem.

1. Go to the Security tab and click Report a vulnerability. That opens a private advisory only you and I can see.
2. Include what you found, how to reproduce it, and what an attacker could do with it.

I'll acknowledge the report within 3 days, share a fix plan within 7 days, and credit you in the release notes unless you'd rather stay anonymous.

• Dependabot checks dependencies and GitHub Actions every week and opens update PRs.
• CodeQL scans the code on every pull request and once a week.
• Secret scanning and push protection block committed API keys and tokens.
• CI must pass before anything merges into the default branch.

_{© 2026 Dajoni Gomez · Uncook™ · part of the journey log}