Don't open a public issue. Use GitHub private vulnerability reporting for this repository instead, so the report isn't visible before a fix is available.

If that's not accessible to you for some reason, contact @ToniSeas directly.

This covers the site itself: its code and its npm dependencies, such as a vulnerable package or a cross-site scripting issue on a page. The code of each project has its own security policy, in its repository. A page with wrong information is a normal bug, so open an issue for it.

Only the live site, built from main, is supported.

This project is maintained by one person in their spare time. There's no guaranteed response time, but security reports get priority over other issues.