Please do not open public issues containing secrets, production database URLs, Supabase service-role keys, reviewer identities, unpublished submissions, private storage URLs, or user data.

For sensitive reports, contact:

hi@yitongsun.com

• Keep .env.local out of git.
• Rotate any key that has ever appeared in public logs or commits.
• Keep SUPABASE_SERVICE_ROLE_KEY server-only.
• Review Supabase RLS and storage policies before production use.
• Keep rate limiting and suspicious-activity detection enabled in production.
• Review Vercel cron endpoints and protect maintenance routes where appropriate.