The website is not an infallible authority; compromised JavaScript could display a false result.
The project therefore includes an independent CLI and inspectable evidence bundle.
No official security mailbox is published yet; a verified reporting route is still pending.