Security fixes are made on the latest commit of the main branch. Older deployments and forks must update or apply the relevant fix themselves.

Do not disclose a vulnerability in a public issue, discussion, pull request, log, screenshot, or sample file.

Use GitHub's Security > Report a vulnerability flow when private vulnerability reporting is available. If that option is unavailable, contact the repository owner through their GitHub profile before sending technical details.

Include only the minimum information needed to reproduce the problem. Never include:

• Swiss Golf usernames, passwords, or GolfBox tokens;
• raw WHS exports or Workers KV snapshots;
• real player names, membership identifiers, club identifiers, or round data;
• Cloudflare credentials, secret values, or full request/response logs; or
• screenshots that contain account, player, deployment, or browser-profile information.

Use synthetic placeholders and redact unrelated values. If a credential may have been exposed, rotate it immediately through the relevant provider rather than waiting for a code fix.

This repository is an unofficial, read-only client for undocumented upstream services. Every fork owner is responsible for securing their Cloudflare account, configuring encrypted secrets, obtaining the player's consent before publishing handicap data, and complying with applicable service terms and data protection requirements.