This repository is the source of carletonai.com. Only the live site, built from the master branch, is supported; fixes ship there directly rather than to versioned releases.

Please report suspected security vulnerabilities privately, not in a public issue or pull request:

• Open a private security advisory on GitHub (preferred), or
• email info.carletonai@gmail.com with "Security" in the subject line.

When reporting, please include:

• A description of the issue and its potential impact
• Steps to reproduce (proof of concept if available)
• Affected versions/commit hashes and environment details
• Any suggested mitigations or fixes

We will acknowledge receipt within 3 business days and provide a status update within 7 business days. After validation, we will coordinate remediation and disclosure with you. Please do not publicly disclose the issue until we have released a fix or mitigation and agreed on a disclosure timeline.

If a report is determined not to be a security vulnerability, we will let you know with a brief explanation.