Security fixes are applied to the current default branch.

Please do not open public issues for suspected vulnerabilities. Use GitHub private vulnerability reporting when it is enabled for the repository; otherwise contact the repository maintainer privately with:

• a concise description of the issue;
• affected endpoint, version, or deployment mode;
• minimal reproduction steps; and
• impact and suggested mitigation, if known.

Do not include access tokens, private datasets, SSH keys, or production database contents in a report.

• Copy infra/.env.example to the ignored infra/.env and replace all placeholders before deployment.
• Never commit .env, SQLite databases, runtime records, reports, private keys, or Oracle-specific helper files.
• The public frontend must allow only the intended embedding parents through CSP frame-ancestors.
• Public deployments should use HTTPS, a non-default Django secret key, explicit allowed hosts, and an authenticated mutation policy where multi-user writes are enabled.