Only the latest master deployment at bolao-cog.vercel.app is supported.

If you discover a security issue, please do not open a public issue.

Instead, email the maintainer with:

• A description of the vulnerability
• Steps to reproduce
• Impact assessment (if known)

We will acknowledge receipt within 48 hours and work on a fix before public disclosure when appropriate.

In scope: authentication bypass, unauthorized data access, privilege escalation, injection, and secrets exposure in this repository or its production deployment.

Out of scope: social engineering, denial-of-service, and issues in third-party services (Vercel, Neon, football-data.org).