Do not commit API keys, passwords, tokens, cookies, private prompts, or personal account data. Use environment variables and local secret stores for provider credentials.

Report a security issue privately to the repository maintainers rather than opening a public issue with sensitive details. Integrations should apply least privilege, authorized provider access, input validation, output review, and audit logging.