Allowance moves money on someone's behalf, so security reports are welcome and taken seriously.

Please don't open a public issue for a security problem. Use GitHub's private reporting instead: the Security tab of this repository → Report a vulnerability.

Include what you found, how to reproduce it, and what an attacker could do with it. You'll get a reply within three days.

This is a hackathon project that runs against the PayPal sandbox. No real money moves. The demo is in scope; PayPal, Channel3, Anthropic, Cloudflare and Render are not (report to them directly).

The security requirements are in the Software Requirements Specification (section 3.8.3) and the controls by layer in the Software Architecture Document (section 10).