Security research
A disclosure program is being prepared.
Do not test against third-party systems, real user data, or any public service without a published scope and authorization.
Current scope
There is no public bounty or authorized production target. Local source review and synthetic fixtures are the safe current surfaces.
Before launch
A monitored reporting channel, safe-harbor language, severity process, response targets, and coordinated-disclosure policy must be approved and published.