Do not commit credentials. SourceMender reads Bright Data and optional model credentials only from environment variables. The Bright Data key is registered with the output redactor, and common credential shapes are rejected or redacted before evidence is persisted.

• Bright Data operations are typed enum variants. Credentials never enter argv or a shell command.
• The Bright Data subprocess starts after env_clear and receives only the documented environment allowlist.
• Captured worker text is bounded and redacted before it can become an error or artifact.
• Collector payloads, run-journal details, and encoded receipts reject credential-shaped text and private absolute paths at their persistence boundaries.
• Receipt artifact references are project-relative validated paths, not ambient filesystem locations.

Set SOURCEMENDER_REMOTE_EFFECTS=deny to prevent every live Bright Data read or mutation while retaining the offline fixture workflow.

Ignored files are not a security boundary. Keep credentials out of fixtures, examples, logs, screenshots, and preserved evidence even when a matching ignore rule exists.

Please report security issues privately to the repository owner rather than opening a public issue.