• Reddit OAuth credentials and editorial-backend credentials are stored outside this repository in environment variables, a secret manager, or the production credential store.
• Real .env files are ignored; .env.example contains placeholders only.
• Credentials should be rotated promptly if compromise is suspected.

• Use least-privilege API access and HTTPS for outbound requests.
• Avoid logging authorization headers, passwords, access tokens, refresh tokens, or credential-bearing URLs.
• Keep retrieval limits low and use only the documented allowlist.
• Use sanitized or synthetic data in public examples and tests.

This public repository contains no production server addresses, SSH material, database credentials, n8n credentials, encryption keys, private backend secrets, cookies, or session tokens.