Security fixes target the latest commit on main and the latest GitHub release. Older development snapshots are not supported.

Please do not open a public issue for a suspected vulnerability. Use the repository’s Security → Report a vulnerability form (GitHub private vulnerability reporting). Include affected versions, reproduction steps, impact, and any suggested mitigation. If private reporting is not enabled yet, ask the maintainer to enable it without posting exploit details.

DraftLab is a localhost application, not an internet-facing service. The web API binds to 127.0.0.1 and rejects non-loopback Host and Origin headers. Do not place it behind a public reverse proxy or bind it to a LAN/public interface without a separate authentication and threat-model review.

Keep .env, data/, backups, player tags, and API tokens out of commits and issue attachments. Rotate a token immediately if it is exposed.