MortgageFlow uses synthetic demo data only.

Do not add, seed, log, or document real borrower data. The project must not store:

• Social Security numbers
• Bank account numbers
• Credit reports
• Tax returns
• Government IDs
• Real mortgage documents

Do not commit JWT signing keys, SQL passwords, demo passwords, API keys, or connection strings containing credentials. Use environment variables, user-secrets, or .env files ignored by Git.

Record security issues privately until they can be fixed without exposing sensitive details.