If you discover a security vulnerability in this codebase, please do not open a public GitHub issue. Instead, email:

a.piotrowski@ktzr.pl

I will acknowledge within 72 hours and work on a fix.

This project handles sensitive data (legal cases, client information). Issues of particular interest:

• Authentication / authorization bypass (doGet access control)
• Data leakage (e.g., logs exposing PII to non-domain users)
• Injection vulnerabilities (Sheets formula injection, HTML injection in UI)
• OAuth scope misuse
• Insecure defaults in Setup that could lead to data exposure

• Vulnerabilities in third-party dependencies (Bootstrap, Chart.js loaded from CDN) — please report those to upstream maintainers
• Vulnerabilities requiring physical access to a logged-in user's machine
• Self-inflicted issues (e.g., committing your GEMINI_API_KEY to a public repository after cloning this one — please use Script Properties)

This is open-source code that you deploy in your own Google Workspace. You are responsible for:

• Keeping your Gemini API key and other secrets in Script Properties, not in code
• Reviewing OAuth scopes in appsscript.json against your firm's policies
• Configuring deployment access (USER_ACCESSING + domain restriction)
• GDPR / professional secrecy compliance for your jurisdiction
• Backing up your data (this is a thin layer over Google Sheets — Google's retention policies apply)