Email contact@electionssimplified.com with a description, steps to reproduce, and the impact you see. Do not open a public issue for security problems.

We aim to acknowledge reports within 3 days and to ship a fix or share a timeline within 14 days for confirmed issues; these are targets for a small team, not guarantees. We will credit you in the fix unless you ask us not to.

Good-faith research that stays within scope, does not access or alter other people's data, does not degrade the service, and is reported privately to the address above is welcome; the Terms of Use rule against probing the service is not meant to stop that.

• This repository and the deployed site at electionssimplified.com.
• Anything that exposes user accounts, ballot drafts, or member payment state, or that lets someone alter election data shown to voters.

Out of scope: rate-limit findings without a working bypass, reports from automated scanners with no reproduction, and issues in third-party services we depend on (report those upstream).

Only the main branch and the current deployment receive fixes.