Please do not open a public issue for security vulnerabilities. Instead, report them privately:

• Email edy.cu@live.com, or
• Use GitHub's private vulnerability reporting (Security → Report a vulnerability).

You'll get an acknowledgment within 48 hours and a resolution timeline after triage. Please give us a reasonable window to patch before public disclosure.

Porchlight never stores credentials in the repository. The Minds Builder API key lives only in a gitignored .env (or ~/.config/), and the app runs fully in MOCK mode without any key.