Password Arena is intentionally limited to synthetic, local experiments.

Do not use this project to:

• collect or test real credentials;
• connect to login pages, identity providers, or production systems;
• automate credential stuffing or unauthorized password guessing;
• process leaked credential datasets containing personal information.

Open a private GitHub security advisory rather than a public issue when the repository supports advisories. Include reproduction steps, affected versions, and expected impact.