Please do not open a public issue for a suspected vulnerability. Use the repository's Security → Report a vulnerability form on GitHub so the report can be discussed privately.

Include the affected version, deployment method, reproduction steps, and expected impact. Do not include live access tokens or personal GitLab data.

• OAuth uses Authorization Code with PKCE and a non-confidential client.
• Browser tokens are kept in sessionStorage, never in published files.
• Personal and project-level data are fetched directly from GitLab with the signed-in user's permissions.
• The optional Pages dataset is aggregate and anonymized.

Self-managed operators remain responsible for TLS, GitLab access policy, OAuth application settings, CI/CD variable protection, updates, and token rotation.