Please do not post vulnerabilities, private claimant information, tokens, or credentials in public issues or pull requests. Report vulnerabilities privately through GitHub private vulnerability reporting or email leongshiwei0@gmail.com. Include reproduction steps and affected versions when possible. Do not send secrets or claimant records in an initial report.

If a private channel is not yet configured, ask the repository maintainers to provide one without disclosing exploit details publicly. This template ships with no default administrator, cron secret, or operational service credentials. Keep each deployment's Supabase keys and scheduler secret in its own secret store.