Security Report sensitive issues via GitHub Security Advisories (if enabled) or a private channel — not a public issue. The demo app is a sample (H2, open endpoints for learning). Do not deploy it as production.