• Never commit .env or any real API keys. Report leaked keys immediately and rotate them.
• The install scripts fetch third-party code from fixed upstream repositories; review before use in sensitive environments.
• Research data stays local; do not push .research/, data/, or models/ to this repository.

To report a vulnerability, open a private security advisory on GitHub or contact the repository owner directly.