Please do not open public issues for security vulnerabilities.

Use GitHub Security Advisories for private reports on this repository. If you cannot access advisories, contact a maintainer privately and include:

• affected component
• impact
• reproduction steps
• suggested remediation

• Never commit real API keys, tokens, or credentials.
• Use .env for local secrets.
• Keep .env.example non-sensitive.
• Run pre-commit run --all-files before opening PRs.

If a secret is exposed:

1. Revoke/rotate the secret immediately.
2. Remove leaked values from runtime/config.
3. Replace history if required by provider policy.
4. Open a remediation PR and describe impact.

Security or CI exceptions must be temporary and accountable.

• Record them in .github/ci-exceptions.json.
• Every exception needs a named GitHub owner and a tracking issue or PR.
• Default SLA is 14 days from openedOn to expiresOn.
• Expired exceptions are expected to fail CI until renewed or removed.