Use GitHub's private vulnerability reporting on this repository: open the Security tab and choose "Report a vulnerability". Reports go directly to the maintainer and stay private until a fix is out.

Please do not open public issues for security problems.

The production site (www.pairbook.io) is fully static: no server-side code, no database, no authentication, no cookies, no third-party scripts. The main areas of interest are:

• The build pipeline (pipeline/) and its handling of upstream data.
• The GitHub Actions workflow and its permissions.
• Response headers and cache rules (pipeline/build.py, generated site/vercel.json).

The IndexNow key in config.json is intentionally public; the protocol requires the key to be served from the site root.