Please email security@flipthiscrypto.com for any security vulnerabilities instead of using GitHub issues.

• ✅ No hardcoded secrets, API keys, or credentials
• ✅ No sensitive environment variables committed
• ✅ .gitignore properly configured
• ✅ Dependencies kept up to date
• ✅ External API calls use environment variables only

1. Never commit .env, .key, credentials, or token files
2. Use .env.example to document required environment variables
3. Keep dependencies updated (npm audit, pip audit, etc.)
4. Report security issues confidentially
5. Don't log sensitive data (API keys, tokens, passwords, PII)

Before deploying:

• All secrets are in environment variables
• No .env files are committed
• Dependencies are audited and updated
• Sensitive logs are disabled
• HTTPS is enforced

Last Updated: 2026-02-26