- Never commit
.envor any real API keys. Report leaked keys immediately and rotate them. - The install scripts fetch third-party code from fixed upstream repositories; review before use in sensitive environments.
- Research data stays local; do not push
.research/,data/, ormodels/to this repository.
To report a vulnerability, open a private security advisory on GitHub or contact the repository owner directly.