This is an early-stage project. If you find a security issue:

• Do not open a public issue for anything exploitable.
• Report it privately to the repository owner (GitHub private message or a security advisory).
• Include steps to reproduce and the impact.

Never commit secrets. Keys belong in a git-ignored .env; see .env.example for the expected variables.