This repository contains only the public marketing/research site for the MEDomicsLab. It is a static Vite + React 18 single-page app: no backend, no database, no authentication, and no user data is collected or stored by the site itself.

In scope:

• The website code in this repository (Vite/React app, build output served from dist/).
• The CI workflows under .github/workflows/.
• Dependency vulnerabilities affecting the production bundle.

Out of scope:

• Third-party services linked from the site (publishers, DOI providers, social platforms, embedded video stream).
• Research datasets, none are stored in this repository, and none must ever be added (see "Research data" below).
• The medomics.app hosting infrastructure (report directly to the site administrator).

Please do not open a public GitHub issue for security problems.

• Preferred channel: GitHub private vulnerability reporting.
• Email fallback: simon.gilbert.provost@gmail.com

Please include:

1. A description of the issue and its potential impact.
2. Steps to reproduce, ideally with a minimal proof of concept.
3. Affected URL(s) / commit / file(s).
4. Whether the issue is already publicly known.

We will acknowledge your report within 72 hours and aim to provide a status update within 7 days. Coordinated disclosure is appreciated, please give us a reasonable window to ship a fix before going public.

No real-world clinical or patient datasets are shared through this repository. Please do not include any in pull requests, issues, screenshots, attachments, or markdown content. If you spot any such material in the repository or on the site, treat it as a security concern and report it via the channels above.

Only the main branch (deployed at https://medomics.app/) is supported.