Reporting a vulnerability

Open a private security advisory on the repository. If you cannot, open a normal issue that says only that you have found a security problem and how to reach you, with no details in the public thread.

Please give us a reasonable window to fix an issue before publishing it.

Anything that lets one account read or change another account’s data, anything that lets an unauthenticated request reach a protected route, and anything that causes Pepiros to attribute a quote to a source it did not come from.

That last one matters as much as the first two here. A grounding tool that can be made to point at the wrong sentence has failed at the only thing it claims to do.

Sessions are signed HTTP-only cookies. Protected routes are enforced in middleware, not only hidden from search engines. MCP tokens are scoped and revocable.

There is no bug bounty, no formal SLA, and no third-party audit. This is a two-person project, and pretending otherwise would be its own kind of security problem.