Report vulnerabilities privately to contact@arca.computer, with the repository/version, affected route and a minimal synthetic reproduction. Do not post attendee data, real codes, cookies, tokens or provider credentials in an issue. Do not test another operator's deployed event without permission.

See the security model, backend details and verification limits. This is a self-hosted single-event toolkit, not a hosted service or audited multi-tenant platform.

Sign-in, feedback, real distribution, mail and photos are off by default. Keep runtime, admin, operator and private sender database privileges separate. Never publish the R2 bucket, use a broadly privileged mail key on the public Worker, or treat login access as attendance/benefit eligibility.

Private free text and photo originals are not automatically safe to forward. Photos are not guaranteed metadata-stripped or server-decoded. Retention cleanup preserves receipt/assignment history to prevent reallocation or resurrection. Deployment configuration and consent policies remain the operator's responsibility.