Please report security issues privately to the project maintainer instead of opening a public issue. Include:

• affected commit or version,
• impact and reproduction steps,
• whether credentials, private feed URLs, logs, or database contents may have been exposed,
• suggested remediation if known.

The maintainer will triage the report and coordinate a fix before public disclosure when appropriate.

This project should not contain live secrets or private deployment values in tracked files.

Do not commit:

• .env or other local environment files,
• LLM API keys, endpoint credentials, or model deployment identifiers that are private,
• Bluesky App Passwords,
• personal FetchRSS feed URLs,
• local SQLite databases,
• raw logs or support bundles containing credentials or private endpoints.

Use .env.example for placeholders only. Live deployment values belong in process environment variables, secret managers, or hosting-platform secret stores.