Security and privacy fixes are applied to the current deployed version. Published vocabulary releases remain available for compatibility but may not receive site-code updates.

Use GitHub's private vulnerability reporting for vulnerabilities that could expose deployment credentials, inject active content, compromise generated badges, bypass the build, or create cross-site scripting. Do not include secrets in an issue.

Content disagreements, incorrect classifications, translation errors and factual corrections are public issues, not security reports.

The project does not operate accounts, analytics or a declaration registry. A badge is a public self-declaration, not a security certificate or proof of authorship.