Do not open a public issue for a suspected vulnerability or include credentials, tokens, cookies, portal HTML, documents, or personal data in reports.

Report vulnerabilities privately through GitHub Security Advisories. Include the affected version, impact, reproduction using synthetic data, and a proposed mitigation when available.

Supported security fixes target the latest release. Operators should pin the lockfile, run the dependency audit, use TLS, keep PUBLIC_BASE_URL stable, restrict allowed hosts and origins, run SQLite persistence on one trusted instance, protect and back up the state encryption key separately from the database, and rotate deployment secrets independently of university accounts.

Tools that accept upstream paths or URLs enforce a fixed HTTPS University origin and reject cross-origin redirects. New wrapper methods must not be exposed until their outbound target and output models have been checked for SSRF, hidden form fields, cookies, CSRF/session keys, signed URLs, or mutation payloads.

Alma, ILIAS, Moodle, Mail, and PPI use separate OAuth scopes and independently revocable upstream sessions. Mail clients are memory-only and must never be serialized. Persisted PPI cookies are revalidated before use. PPI downloads accept only non-empty ZIP responses and are capped at 20 MiB. This release exposes no room booking, registration, submission, outbound message, Mail mutation, PPI signup, borrowing, or token-request action.