Please do not open a public issue for a security vulnerability.

Use GitHub's private vulnerability reporting if it is enabled for this repository. If it is not enabled, contact the repository owner directly through their GitHub profile.

Security reports are useful when they affect the reusable boilerplate itself:

• Auth or authorization bypasses.
• Unsafe default configuration.
• Secret leakage.
• Webhook signature validation problems.
• Billing or balance integrity issues.
• Cross-tenant data access.
• Dependency vulnerabilities with a practical exploit path.

This repository intentionally does not include live production secrets, production hostnames, customer data or payment product IDs.

This starter currently tracks main. Security fixes should target main unless release branches are introduced later.