lvdplm handles EN 9100 QMS records (parts, BOMs, documents, production/serial data, RMAs) for an aerospace/defense supplier — please report suspected vulnerabilities privately rather than as a public issue.

• Preferred: open a GitHub private security advisory on this repository.
• Otherwise: contact the maintainer directly (see repository owner contact info) — please don't file a public issue for anything that could expose a real deployment before a fix ships.

Include what you found, how to reproduce it, and its potential impact. We'll acknowledge reports and follow up with a timeline once triaged.

This covers the application (backend/, frontend/) and the deployment artifacts in this repo (docker-compose.prod.yml, deploy/). It does not cover the security of a specific deployment's infrastructure (TLS certificates, host hardening, network exposure) unless the issue traces back to a default or instruction in DEPLOYMENT.md.