This repository is a sanitized, from-scratch educational case study. It contains a mock adapter and fabricated examples, not a production platform integration.

Do not publish an exploit or sensitive finding in a public issue. Report it privately to the repository owner with the affected version, reproduction steps, impact, and a minimal proof of concept. Do not include real credentials, personal data, customer data, or private platform content. Allow reasonable time for assessment and remediation before disclosure.

• Use only fabricated data and reserved domains such as example.test in examples and tests.
• Never commit tokens, cookies, secrets, private keys, internal links, tenant or user identifiers, storage locations, or environment dumps.
• Never add company source code, customer or brand names, employee names, private pricing, contracts, sensitive or unapproved internal metrics, or unsanitized screenshots. The explicitly approved aggregated original-deployment outcomes in the README and business case are not Demo telemetry.
• Keep .env files out of version control. .env.example may contain names and non-secret defaults only.
• Treat request bodies and operational logs as potentially sensitive. Production logs should be access-controlled, minimized, and retained only as long as required.
• Grant a production application identity only the permissions required for approved creation, import, and ownership-transfer operations.

API failures use bounded error codes and fixed messages. Public receipts must not expose the original request, idempotency key, adapter response body, stack trace, or credential material. Detailed diagnostics belong only in protected operational telemetry.

The included in-memory store is not appropriate for durable or horizontally scaled deployment. A production implementation needs durable state, atomic claim/lease or distributed coordination, recovery, audited access controls, and platform-policy review.