Please report vulnerabilities privately through GitHub security advisories, not in public issues.

Scope includes the site itself (sessions, CSRF protection, the CSP, the playground sandbox at /playground/run, rate limits) and the submission bot workflow, which handles untrusted component code.

Only the latest release is supported.