If you find a security problem in any repository in this organization — a leaked credential, a vulnerable dependency, an injection path in a build script — please report it privately rather than in a public issue.

Use GitHub's private vulnerability reporting on the affected repository (Security → Report a vulnerability), or email the contact address on the organization profile. Say which repository and which file, and include steps to reproduce if you have them.

We will acknowledge within five business days.

• Repositories here publish static sites, analysis code, and data-fetch scripts. No repository holds credentials. Fetch scripts read API keys from a local .env at run time; if you ever see a key committed anywhere in this organization, that is a bug — report it.
• Continuous integration runs only on trusted branches with read-only tokens. Workflows from forks do not receive write access.
• Data-fetch scripts contact third-party public APIs (U.S. Census Bureau, Bureau of Labor Statistics, USPTO, OpenAlex, and others named in each repository's source registry). Review them before running them on your own machine, as you would any script.

Findings about the content of an analysis — a wrong number, a misread source, a missing limitation — are welcome and important, but they are not security reports. Open a public issue on the repository instead; the "Report an error in a published figure" template is there for exactly that.