This project is currently supported only on the latest version available in the default branch.
| Version | Supported |
|---|---|
| Latest | ✅ |
| Older versions / previous commits | ❌ |
If you believe you have found a security vulnerability, please do not open a public issue.
Instead, report it privately by emailing:
Include as much of the following as possible:
- a clear description of the issue
- steps to reproduce it
- the affected file, feature, or component
- proof-of-concept code or screenshots, if relevant
- the possible impact
- I will try to acknowledge receipt within 3–7 days
- I will review the report and determine whether it is a valid security issue
- If accepted, I will work on a fix and may temporarily keep details private until the fix is available
- If the report is not accepted as a security issue, I will explain why where possible
- Public issues used to report vulnerabilities may be closed without discussion and moved to a private channel if possible
- I appreciate responsible disclosure and good-faith reports
scripts/map_server.js is intended for trusted local development. Before
making it reachable from another device, set both MAP_SERVER_KEY and an exact
ALLOWED_ORIGIN. The empty key and wildcard origin defaults must not be used on
a public network. Saved JSON maps are untrusted input and remain subject to the
5 MiB request limit and fixed maps-directory containment.