This repository must not contain:

• API keys, OAuth tokens, cookies, passwords, private keys, or account exports;
• local Grok/Codex configuration files;
• session logs or raw production traces;
• private hostnames, server addresses, or personal filesystem paths.

Run scripts/secret-scan.ps1 before every public push.

Use GitHub's private security-advisory flow for suspected credential exposure. Do not paste live credentials into a public issue.