This repository must not contain:
- API keys, OAuth tokens, cookies, passwords, private keys, or account exports;
- local Grok/Codex configuration files;
- session logs or raw production traces;
- private hostnames, server addresses, or personal filesystem paths.
Run scripts/secret-scan.ps1 before every public push.
Use GitHub's private security-advisory flow for suspected credential exposure. Do not paste live credentials into a public issue.