If you discover a security vulnerability, please report it via GitHub's private vulnerability reporting feature. Do not open a public issue.

Please include:

• A description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact

We aim to acknowledge reports within 48 hours and release a fix within 90 days. We will coordinate with you before any public disclosure.

• JWT secrets: The example uses JWT_SECRET env var with a dev fallback. Production must set this explicitly.
• Vault tokens: VaultConfig defaults to http://localhost:8200 with token root — these are development defaults and must be overridden in production.
• CORS: The example applies a permissive CorsLayer for local development. Do not copy this to production without restriction.