Do not post API keys, browser sessions, production screenshots, image payloads, or personal data in issues. Report implementation vulnerabilities with a minimal synthetic reproduction. Rotate any credential that is exposed accidentally.