This application is finished on purpose and receives no feature work. Its dependencies stay current through automated updates that pass the same pipeline as every other change, and the controls the README walks through, object-level authorization, tokenized values, audit logging, remain as built. A vulnerability report is still welcome and still triaged: a finished reference application that carries a known flaw is worse than none.

Report suspected problems privately through GitHub's security advisories, at https://github.com/tltaylor1/secure-expense-mvp/security/advisories/new, which is the Security tab of this repository, then "Report a vulnerability." Do not open a public issue or pull request for a suspected vulnerability before it has been triaged.

A useful report includes the affected file or behavior, the impact as you understand it, and reproduction steps. Do not include real credentials or personal data in a report.

What to expect: acknowledgment within seven days, a triage answer within fourteen, and disclosure coordinated with the reporter once a fix exists.