Security fixes are applied to the current main branch. This project is an MVP and does not currently maintain older release branches.

Do not open a public issue containing credentials, personal data, exploit details, or a working proof of concept. Contact the repository owner privately and include:

• the affected endpoint or component;
• the impact and prerequisites;
• minimal reproduction steps;
• suggested mitigation, when available.

Never include live API keys, access tokens, refresh tokens, database credentials, or user-uploaded files in a report.

• Backend secrets are provided through user-secrets, environment variables, or the deployment platform's secret manager.
• Access tokens remain in browser memory; refresh tokens use scoped HttpOnly, Secure cookies.
• Administrator password login requires a short-lived, single-use email OTP before any access or refresh token is issued in production.
• Production deployments use HTTPS, explicit CORS origins, trusted reverse proxies, a least-privilege database identity, and provider-side quota limits.
• Production database connections keep transport encryption enabled, reject trusted-certificate bypasses and the sa account, and apply migrations as a separate release step rather than during API startup.
• The current release fails closed to a single API instance; horizontal scaling is rejected until rate limits, security-state invalidation, and SignalR state are distributed.
• Dependency audits, repository hygiene checks, CodeQL, backend tests, and frontend production tests must pass before release.

The following items remain mandatory before enabling public registration:

• rotate exposed or previously committed credentials and clean repository history;
• verify the production Resend sending domain, publish its SPF/DKIM records, store the API key in the hosting secret manager, and exercise the already implemented confirmed-registration and single-use password-reset flows;
• verify the administrator MFA mail flow against the production Resend domain and keep the production MFA policy enabled;
• verify TLS, reverse-proxy trust, database least privilege, backups, and restore procedures in the target hosting environment;
• keep the API replica count fixed at one; distributed rate limiting, security-state storage, and a SignalR backplane are required before raising it.