If you discover a security issue in vlr-scraper (for example leaked credentials in logs, unsafe deserialization, or path traversal):

1. Do not open a public GitHub issue.
2. Email or contact the maintainer via GitHub: @ark-daemon.
3. Include steps to reproduce, impact, and any suggested fix.

We will acknowledge reports as soon as practical and coordinate disclosure.

• Never commit .env, browser session cookies, or SQLite databases with production data.
• Use a descriptive User-Agent with a real contact address.
• Scraping third-party sites may violate their Terms of Service; that is a user responsibility.