plates handles sign-in, location-adjacent restaurant search, Firestore data, comments, and admin approval. Credential leaks, auth bypasses, or unintended access to user/comment data should be treated as security issues.

Do not open a public issue. Use GitHub's private vulnerability reporting:

• Open the Security tab for this repository.
• Start a private advisory.
• Include a short reproduction and the commit or branch you tested against.

Useful reports usually include:

• what an attacker can read, change, or trigger
• what access is needed to reproduce it
• platform tested: Android, iOS, web, Windows, or emulator
• relevant Firebase/Auth/Firestore rules if the issue depends on them

Expect an acknowledgement within 3 working days and an initial assessment within 10. Credit will be included in the advisory unless you prefer to stay anonymous.

In scope:

• Firebase Auth sign-in, sign-up, and Google Sign-In behavior
• Firestore access to eateries, comments, and admins
• admin-only approval behavior
• leaked or unrestricted API keys, Firebase config, or Google Maps/Places keys
• comment spoofing, cross-user writes, or unintended data exposure
• crashes caused by malformed Google Places or Firestore data

Out of scope:

• reports that require control of the maintainer's Firebase or Google Cloud account
• denial-of-wallet findings on a deployment you control
• scanner-only reports without a working reproduction
• issues already documented as development setup gaps unless they expose data or credentials in a new way

• Do not ship a Google API key directly from lib/globals.dart. Move it to a platform-specific or build-time configuration path, rotate exposed keys, and restrict every key by app, API, and environment.
• Keep Firebase config files scoped to the app they serve. Do not reuse a production Firebase project for casual local testing.
• Lock Firestore rules so normal users can suggest eateries and write their own comments, while only admins can approve restaurants or edit admin records.
• Treat the admins collection as privileged data. A write to that collection is effectively an app-level permission change.

This repository is pre-release. Fixes land on main, and anyone running a copy should track the latest commit.