Do not report vulnerabilities in public issues. Send a private report through the repository's Security tab using GitHub private vulnerability reporting.

Never commit API keys. Local .env files are ignored; automation credentials belong in GitHub Actions repository secrets.