The public GitHub release tracks the current main branch and tagged releases. Security fixes are applied to the latest release line first.

Please do not open a public issue for suspected vulnerabilities. Contact the maintainer through the profile or repository contact channel and include:

• affected version or commit hash,
• minimal reproduction steps,
• expected and observed behavior,
• deployment context, especially whether the app is embedded in an iframe.

• SECRET_KEY must be provided through the environment and must never be committed.
• Uploads are restricted to UTF-8 .xyz files and a configured size limit.
• Result downloads are session-scoped, with a referer fallback for embedded deployments.
• Production deployments should run behind HTTPS, typically through Caddy or another reverse proxy.
• Local Oracle/Caddy helper files are intentionally ignored because they may contain hostnames, key paths, or machine-specific settings.

The referer fallback for downloads is intentionally documented as a compatibility path for embedded deployments. A signed, session-scoped download token would be stronger for future public deployments.