The current main branch is supported. This project has no deployed backend and does not process production data.

Report a suspected vulnerability through the repository's GitHub Security Advisory interface when available. Do not include real ERP data, credentials, tokens, or proprietary metadata in a report.

• Static assets only; no server-side mutation endpoint.
• No authentication or authorization simulation.
• No telemetry, analytics, cookies, local storage, service worker, or background synchronization.
• No external scripts, styles, images, fonts, or runtime package dependencies.
• No dynamic code execution.
• Strict JSON prototype, symbol, recursion, safe-number, decimal, and timestamp validation.
• Strict OData path, key, query-option, field, type, and action validation.
• Atomic cloned units of work; invariant failure publishes no partial state.
• If-Match and generation/revision ETags for optimistic concurrency.
• Idempotency fingerprints bind method, path, and exact body text.
• Replay checks exact outcomes and final content/state/trace digests.

The workbench CSP limits scripts, styles, connections, images, forms, objects, frames, fonts, and workers to the minimum static profile. UI rendering uses DOM creation and textContent; it does not use HTML string injection.

All runtime state lives in the current JavaScript process and is reset by reloading. A user can inspect or alter local state with developer tools. Do not treat this simulator as a security boundary, accounting system of record, or source of authorization decisions.

The synthetic origin uses the reserved .example domain. Fixture telephone values use the reserved +1-202-555-01xx range. Never replace them with live personal or customer data.

Static ERP Operations Lab is independent and unaffiliated. SAP and SAP S/4HANA are trademarks of SAP SE or its affiliates. No SAP logos, UI assets, UI5 code, fonts, icons, screenshots, CSS, metadata dumps, or copied vendor prose are included.