Report vulnerabilities through GitHub private vulnerability reporting rather than a public issue. Include impact, reproduction steps, and affected versions without real credentials or sensitive files.

This repository is a reference implementation. The Compose stack is not an internet-ready deployment. Use a managed secret store, TLS, private networking, least-privilege service accounts, malware-signature monitoring, and an authenticated authorization service before production use.