Current public-alpha boundary
No accounts, comments, uploads, advertising trackers, session replay, or generic chatbot are in scope. Forms require strict same origin, bounded streaming bodies, server validation, HMAC rate limiting, prepared statements, minimal retention, and operational review. A daily scheduled cleanup removes expired form data. Do not send exploit details through ordinary forms; use security.txt.
Accountability
Material corrections receive a dated record. Publisher-level commercial interest is disclosed; no independent review council is currently staffed.