CommonsGate is a synthetic hackathon prototype. Do not submit real personal, legal, housing, health, benefits, or emergency-service data.

Please use this repository's Security → Report a vulnerability flow so the report and reproduction details remain private. Include the affected revision, impact, and the smallest safe reproduction you can provide. Do not open a public issue for an unpatched vulnerability and do not include real resident data.

The maintainers will acknowledge a report when available, validate its scope, and coordinate a fix before public disclosure. This project does not currently offer a bug bounty or guaranteed response time.

Only the latest commit on main is supported. The synthetic HMAC identity issuer, static demo administration credential, and public/private API co-location are explicit prototype boundaries, not production security claims.