This is a guide for volunteer organizations. No code to exploit, two things worth reporting fast anyway.

Guidance that would hurt a club or a kid. Boards run real money and real family data off these pages, so a control that fails, a data practice that exposes children, or advice that backfires at a cash table has victims who volunteered. Open an issue, it jumps the queue.

Anything identifiable. No club, school, family, or child should be recognizable anywhere in this repo, in content or contributions, and this line is the brightest one on the account. If you spot a violation, do not open a public issue. Use GitHub's private vulnerability report on this repo, or the contact on my profile, and it gets handled quietly and immediately.

No bounty program. The reward is a band trip that was only ever about the music.