Please report a vulnerability privately, through GitHub's private vulnerability reporting, not in a public issue. Say what is affected and how to reproduce it; you will hear back within a week.

In scope: the code in this repository and the site it runs, rss.mobi — for example a way to fetch internal addresses through feed discovery, to read or change a feed without its edit link, or to get a page to show crawlers something different from readers.

Out of scope: rate limits being reachable, missing security headers with no demonstrated impact, and reports produced by automated scanners alone.