Do not open a public issue for a suspected vulnerability or exposed credential. Contact the repository owner privately with:

• A short description of the issue.
• Reproduction steps or a minimal proof of concept.
• The affected version or commit.
• Any suggested mitigation.

Please avoid accessing, modifying or retaining data that does not belong to you.

• Never commit real credentials, private keys, access tokens or webhook URLs.
• Keep deployment-specific configuration outside tracked files.
• Use .env.example for documented variable names and safe placeholders.
• Do not add a private project as a remote, submodule or workspace dependency.
• Review dependency licenses before adding or upgrading packages.
• Run pnpm check:safety before publishing a release.

Security fixes are applied to the current main branch. Older snapshots are not maintained unless a release policy says otherwise.