RetroBytes is a personal portfolio and learning project. It is a demo application, not a production service, and it is not deployed with real user data. There is no bug bounty and no financial reward for reports.

That said, security feedback is genuinely welcome, since the point of this project is to practice secure software engineering.

If you find a security issue, please report it privately rather than opening a public issue:

• Use GitHub's private vulnerability reporting for this repository (the "Report a vulnerability" button under the Security tab), or
• Open a regular GitHub issue if the finding is low risk and not sensitive.

Please include enough detail to reproduce the issue: affected file or endpoint, steps or a proof of concept, and the impact you observed.

• This is a single-maintainer learning project, so responses are best effort and may take time.
• Findings that reflect a real weakness in the application code are the most useful. Issues that only apply to a specific misconfiguration of a local demo deployment are lower priority.
• There is no service-level agreement and no bounty.

Only the latest commit on the default branch is maintained. Older tags and commits do not receive security updates.