This project currently has one maintained branch: main. Because the application is a static client-side utility, security fixes are applied to the latest main branch rather than to a versioned release line.

Please do not disclose sensitive vulnerability details in a public issue. Contact the repository owner through the GitHub profile for vincenzo-afk and include a concise description, reproduction steps, affected file or behavior, and any relevant browser or service context. Do not include real personal data, access tokens, passwords, or payment details in a report.

The application does not contain a backend or server-side secret store. External API calls are made from the browser and use public endpoints that do not require an application key. The app stores generated synthetic data and disposable-mail credentials in browser localStorage so the current session survives a refresh; users can remove that data with Clear local data.

The UI intentionally does not provide SMS interception, real payment credentials, or automation that bypasses identity, phone, anti-abuse, or authorization controls. External disposable-email providers may retain data according to their own terms, and clearing browser storage does not remotely delete provider-side inboxes.