Report potential vulnerabilities privately with affected path and impact.

• Never commit tokens, private keys, or local key file paths.
• Keep .env local and untracked.
• Use placeholder values in examples.

1. Revoke exposed credentials.
2. Rotate and redeploy.
3. Remove from current branch.
4. Rewrite history if committed.
5. Re-run secret scans.