Security fixes target the current main branch and, after launch, the current public deployment at link42.app. This pre-release repository is not yet the canonical production deployment.

Use GitHub's private Report a vulnerability form in this repository's Security tab when it is available. If it is unavailable, open a public issue asking the maintainers to establish a private reporting channel, but do not include exploit details, secrets, personal information, or sensitive data in that issue.

Include the affected route or component, reproduction conditions, likely impact, and any safe proof of concept. The public website, content pipeline, build workflow, dependency supply chain, source-provenance controls, and publication-safety checks are in scope. Private Link42 platform services are outside this repository's scope and should not be described in a public issue.

There is no bug-bounty programme or guaranteed response time. Please allow a reasonable opportunity to investigate before public disclosure.