Please do not report vulnerabilities or expose school data in public issues. Send security reports privately to contact@datacraze.io.

Include the affected version or commit, steps to reproduce, expected and observed behavior, and impact. Redact credentials, context keys, cookies, tokens, and any identifiable school data from reports and attachments.

The client API security review maps the outbound-client threat boundary and existing controls to Snyk's OWASP API guidance. It also records consumer authorization/serialization responsibilities and local filesystem/persistence limits; it is not a third-party security certification.