Contact Fatemeh Sabourinia through her GitHub profile before disclosing a security, privacy, credential, or restricted-data concern publicly.

Do not submit participant records, competition data, credentials, tokens, private keys, restricted data-dictionary content, sensitive screenshots, or personal local paths through public issues or pull requests. Do not paste secret values into messages. Provide a minimal, redacted description first so a safe follow-up channel can be arranged if needed.

• accidental tracking or exposure of participant-level data;
• exposed credentials or secret-bearing configuration files;
• repository controls that could allow restricted artifacts to be committed;
• unsafe issue or contribution paths that solicit sensitive material.

Reports will be reviewed as availability permits. Acknowledgement or remediation timing cannot be guaranteed. Please avoid public disclosure until the maintainer has had a reasonable opportunity to assess the report.

This policy is not a claim of regulatory, clinical, NHS, or GDPR compliance.