Security fixes are applied to the latest version on the main branch.

Do not publish a security vulnerability in a public issue. Contact the repository owner privately with:

• the affected file or behavior
• reproducible steps
• expected and actual behavior
• potential impact

The application is static and performs all recommendation processing in the browser. It does not collect credentials, personal records, analytics, or user profiles.