Launchpad is a static website and a set of downloadable scripts that run on fictional mock data. The site has no server, database or login. It never connects to a bank, asks for credentials or moves money.

In scope:

• The website in artifacts/starter-kits, including its build and deployment workflow
• Downloadable kit scripts and the ZIP or copy features on the site
• Scripts and CI workflows in this repository

Out of scope:

• Investec's own APIs, sandbox or products. Report those to Investec through its official channels.
• Community projects linked from Launchpad. Report those to their maintainers.

Please report security issues privately. Do not open a public issue or pull request.

1. Go to the repository's Security tab.
2. Select Report a vulnerability.
3. Describe the issue, the steps to reproduce it and its potential impact.

This uses GitHub private vulnerability reporting. Maintainers receive the report privately and can discuss it with you there.

Maintainers aim to acknowledge reports within a few working days and to share a plan for a fix. We credit reporters in the advisory unless you ask us not to.

Never post real banking credentials, API keys, tokens, account numbers or personal data in issues, pull requests, screenshots or logs. If you accidentally expose a real credential, revoke it immediately with your provider, then report the exposure as described above.