Security fixes are applied to the current main branch and the production deployment.

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting feature on the repository's Security tab.

Include the affected route or module, reproduction steps, expected impact, and any suggested mitigation. Do not include credentials, personal data, or exploit traffic against the public deployment.

Flight School has no accounts or backend, but reports involving browser storage, dependency integrity, static hosting configuration, cross-site scripting, or unsafe asset handling are still important.