Please report security issues by opening a private security advisory on GitHub:

https://github.com/jackdu2333/Electronic-Photo-Album-OpenSource-/security/advisories/new

Do not publicly disclose vulnerabilities involving authentication bypass, file access, path traversal, or private photo exposure before a fix is available.

• A description of the vulnerability and its potential impact
• Steps to reproduce or proof-of-concept (if possible)
• Any suggested fix or mitigation

We aim to acknowledge reports within 48 hours and provide a fix within 7 days for critical issues.