The latest GitHub Release receives security fixes. Version 0.1.0 is the first supported line.

Use GitHub's Report a vulnerability private advisory form for this repository. Do not open a public issue containing exploit details or sensitive project data. Include the affected version, a minimal reproduction, impact, and any proposed mitigation.

CoatCart runs locally, makes no network requests, executes no input-provided code, and has no dependencies. JSON is validated at the boundary and user-controlled labels are escaped in HTML and CSV reports. Generated reports can still reveal room measurements, finish names, and prices, so review them before publishing or sharing.