Reviewer intentionally displays vulnerable code snippets. A weakness shown inside a training challenge is expected and is not a vulnerability in Reviewer.

Please report issues that affect the platform itself, including authentication bypass, unauthorized data access, unsafe challenge-pack processing, cross-site scripting in the application UI, or exposed secrets.

Security fixes are applied to the latest commit on the main branch.

Please use GitHub's private vulnerability reporting feature for this repository. If it is unavailable, contact the maintainer through the contact method listed on the GitHub profile.

Include:

• affected component and commit;
• reproduction steps or a minimal proof of concept;
• expected and observed behavior;
• potential impact;
• suggested remediation, if available.

Do not include real credentials or personal data. Please allow reasonable time for investigation before public disclosure.

Good-faith research that avoids privacy violations, data destruction, service disruption, social engineering, and access beyond the minimum necessary to demonstrate an issue is welcomed. This policy does not authorize testing of third-party systems.