This project is a local learning toolkit (static tracker + TypeScript exercises). It does not run a multi-tenant backend.

Please report:

• XSS or HTML injection in ts-tracker.html
• unsafe handling of File System Access API / persisted state
• supply-chain issues in dependencies or CI workflows
• accidental exposure of secrets in docs, scripts, or examples

• unfinished exercises / intentional type errors in lesson TODOs
• learning-content disagreements (use issues / PRs instead)

1. Open a GitHub issue titled [SECURITY] … only if the issue is non-sensitive.
2. For anything exploitable, contact the maintainer privately via the GitHub profile contact options and avoid posting a public PoC.

Please include:

• affected file / commit
• reproduction steps
• impact assessment
• suggested fix if you have one

We aim to acknowledge security reports within 7 days.