Please do not open a public issue for secrets, credential leaks, or vulnerabilities.

Report security issues privately to the repository owner through GitHub contact channels. Include:

• affected version or commit
• reproduction steps
• expected impact
• whether any credential or private document may have been exposed

The project does not intentionally store API keys. LLM keys and service credentials should be supplied through environment variables and should not be written to artifacts, traces, or summaries.