Do not open a public issue for security problems. Use GitHub private vulnerability reporting.

Include what you found, how to reproduce it, and which URLs or files are affected.

Never commit deploy keys, API tokens, or Cloudflare credentials. If you do, rotate them immediately and file a private advisory.

In scope: credential leaks and XSS or injection in this repo’s HTML. Out of scope: issues in Sketchfab’s embed unless introduced by our integration.