Never paste credentials into issues or PRs. If possible, report credential exposure or network/SSRF concerns via private vulnerability reporting. Revoke leaked WordPress application passwords immediately. The software requires HTTPS, isolates secrets in environment variables, and defaults to a no-network dry run for publication, but it has not undergone a professional security audit.