Security fixes are applied to the latest main branch.

Email the maintainers privately (do not open a public issue) with:

• A description of the issue
• Steps to reproduce
• Impact assessment if known

We will acknowledge reports as soon as possible and coordinate a fix before any public disclosure.

• Set ALLOWED_ORIGINS on the Worker to an explicit allowlist (your frontend origin(s)).
• Never expose CLERK_SECRET_KEY, GEMINI_API_KEY, or R2 credentials in the frontend.
• POST /gemini requires a Clerk JWT (owner) or a valid share-link context.
• Email-gated share links require an email query/body parameter for PDF view/download. Email addresses are not cryptographically verified unless you add verification yourself.