Please do not report security vulnerabilities through public issues, PRs, or discussions.

Use GitHub's private reporting instead: open the affected repository, go to Security → Report a vulnerability.

If that option isn't available on the repo, contact the organization owners privately and share details only through a private channel.

Please include:

• What is affected (repo, component, URL).
• Steps to reproduce, or a proof of concept.
• The impact you think it has.

We'll acknowledge the report, investigate, and keep you updated. Please give us reasonable time to fix the issue before any public disclosure.

Anything in this organization's repositories. For problems with the public website or student-facing services, report them the same way.

Do not access, modify, or exfiltrate data that isn't yours while testing, and never test against real student or customer accounts.