Please report security issues privately to arda@codewithmad.com rather than opening a public issue.
Include the affected page or workflow, reproduction steps, potential impact and any safe proof-of-concept details. Do not include real municipal data, passwords or production database content.
Pay particular attention to:
- authentication and session handling
- role and permission checks
- inventory/assignment mutations
- exports and downloadable reports
- setup and configuration files
- database credentials
- user-management operations
Before a production deployment, verify server permissions, PHP/session settings, database privileges, transport security and environment-specific configuration.