Do not open a public issue containing a credential, session identifier, browser state, private path, private source code, or personal/customer data.

Use GitHub's Report a vulnerability flow in this repository's Security tab. If that flow is unavailable, open a minimal issue asking the maintainer to enable a private contact channel; do not include sensitive details.

Include:

• the affected version or commit
• the security boundary that failed
• minimal reproduction steps using fake credentials and disposable files
• the expected safe behavior

Security fixes target the latest release and the default branch.

This project never needs a credential committed to a repository. SOFA API keys, key metadata, skill digests, sessions, cookies, browser profiles, lease databases, and automation memory belong in machine-local secret or state storage.

The lease helper stores local coordination metadata, not authentication data. Its SQLite database must use an absolute path on a trusted local disk. Do not place it on a network share, synchronized folder, or world-writable directory.