This repository is a static website that is continuously deployed from main to pictopy.aossie.org. Only the currently deployed version is supported.

For vulnerabilities in the PictoPy desktop application itself, report them to AOSSIE-Org/PictoPy.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately in one of these ways:

1. GitHub private vulnerability reporting (preferred): open the Security tab and click Report a vulnerability.
2. Email: reach2saksham2004@gmail.com, with [SECURITY] PictoPy-Website in the subject.

Please include:

• the affected URL, file or component
• steps to reproduce, or a proof of concept
• the impact you expect (e.g. XSS, open redirect, supply-chain risk)

• Acknowledgement within 7 days.
• Initial assessment within 14 days.
• A fix, or a mitigation plan, for confirmed issues as soon as practical. We will credit you in the release notes unless you ask us not to.

In scope: the website source in this repository, its build and deployment workflows, and its dependencies. Out of scope: third-party services linked from the site (GitHub, Discord, social networks).