# Security Policy

## Scope

PROJECT EXPRESStoration is a static website and public research repository. It does not operate a backend, authentication service, database, or private API.

Security reports are still welcome for repository or deployment issues such as:

- accidentally committed credentials or secrets
- unsafe client-side behavior introduced by the project
- broken security headers
- malicious or unexpected third-party resource changes
- links or scripts that introduce avoidable security risk

## Reporting

Please open a private security report through GitHub's repository security reporting flow when available. If that flow is unavailable, open a minimal public issue without publishing credentials, tokens, private URLs, or exploit details.

Do not commit secrets into pull requests or issues.

## Response

Reports will be reviewed as soon as practical. Because this is a static open-source project, fixes may consist of removing content, tightening browser policies, updating dependencies or embeds, or correcting deployment configuration.