If you find a vulnerability in Ralphifier, please open a private advisory on the GitHub repository (when available) or contact the maintainer directly. Do not file a public issue for exploitable flaws.

• Never put API keys in client-side code.
• The rewrite endpoint validates JSON, level values, and request size.
• Optional Turnstile / rate-limit hooks exist in the handler but are disabled by default.
• Do not paste production secrets into .env files that might be committed; .env is gitignored.