Please report security issues privately instead of opening a public issue.

Send a short report with the affected starter, a minimal reproduction, and expected impact. Do not include live passwords, provider tokens, database dumps, or VPS credentials.

Starter stacks must use sample values only. Real environment files and production credentials do not belong in this repository.