Report vulnerabilities to sara@sahiurl.in with subject line "Security Vulnerability Report". Provide steps to reproduce; do not access data you don't own; no service disruption; give us reasonable time to fix before public disclosure.

We may acknowledge researchers who follow these rules.