Please do not open a public issue for security vulnerabilities. Instead, report them privately:

• Email edy.cu@live.com, or
• Use GitHub's private vulnerability reporting (Security → Report a vulnerability).

You'll get an acknowledgment within 48 hours and a resolution timeline after triage. Please give us a reasonable window to patch before public disclosure.

CastIron never commits credentials. .env is gitignored (only .env.example is tracked); B2 and provider keys live outside the tree. CI runs the OFFLINE path with no credentials, and secret scanning (TruffleHog + GitHub secret scanning) guards the history.