Report SDK security issues privately to support@sanctionskit.com. Include the affected version, reproduction steps, and expected impact. Do not include API keys or real screening subjects.

Keep keys on your server and grant only the scopes your integration needs. If a key is exposed, revoke it in API keys and create a replacement.

See authentication and SanctionsKit security for service guidance.