USCIS Tracker is a private, self-hosted personal tool, not a public service. It is not hardened for multi-user or production use.
If you find a security issue, please report it privately through GitHub Security Advisories:
Please do not open a public issue for anything security-sensitive.
All secrets (VAPID keys, database credentials) live in server/.env, which is git-ignored. Never commit real keys. Use server/.env.example as the template.