Please report a suspected vulnerability privately through GitHub's security-advisory feature if it is enabled, or contact the repository owner through their GitHub profile. Do not open a public issue containing credentials, private source text, exploit details, or a deployed Worker token.

MapperAPP deliberately ships no hosted API. Users are responsible for securing their own Cloudflare Worker, Anthropic account, API key, and random APP_TOKEN. Rotate either credential immediately if it is exposed. The browser token is an access control for one self-hosted Worker; it is not a substitute for provider-side budgets, monitoring, or rate limits.