SECURITY.md

# Security policy

Do not open a public issue containing a credential, private endpoint, local path, account identifier, customer data, private source, or exploitable production detail.

For ordinary documentation bugs, use a public issue with a fully sanitized reproduction. For a vulnerability, use the private security-reporting channel offered by the repository host. If private reporting is unavailable, do not publish the exploit details; open a minimal issue asking the maintainers to enable a private channel.

The service accepts bearer credentials only in the `Authorization` header. Never place one in a URL, committed config, screenshot, terminal transcript, or issue. Rotate or revoke a credential immediately if exposure is suspected.

The public examples do not auto-approve tools and do not enable arbitrary remote fetching. Community record text must always be treated as untrusted inert data.