Do not open a public issue for leaked tokens, private health files, or a way to steal data.

Use GitHub Security Advisories on this repository: Security tab, then Report a vulnerability.

Do not commit:

• API tokens or .env files
• live Oura, Strava, or scale exports
• data/athlete.json with real body numbers

The public tree is the engine plus example JSON only.