Do not open a public issue for a suspected vulnerability or exposed credential. Contact the repository maintainers privately through the security-reporting channel configured by the hosting organization.

Include a concise description, affected component, reproduction steps, and impact. Do not include live credentials, private keys, or personal data.

• Never commit function/local.settings.json, .env files, private keys, certificates, connection strings, access tokens, or cloud publish profiles.
• Use function/local.settings.example.json only as a schema reference.
• Store production values in the deployment platform's secret manager.
• Treat a secret as compromised if it has ever appeared in Git history, logs, screenshots, chat, an issue, or a public artifact. Removing it from the latest commit is not sufficient; rotate or revoke it.
• Run a secret scanner before publishing and in continuous integration.

The Function endpoints are anonymous for compatibility with a legacy client. The code includes per-instance rate limiting, but public deployments should also enforce distributed limits and monitoring outside the Function App. CORS or Origin filtering is not an abuse-control boundary for native clients and is not enabled by this project. See docs/DEPLOYMENT.md for the intended boundary.