Report security problems directly to a maintainer. Do not put exploit details, credentials, or user data in an issue.

Never commit credentials, model tokens, private media, documents, transcripts, prompts, embeddings from user data, provider responses, or generated user artifacts. Use synthetic fixtures and .env.example.

For the competition MVP, security fixes target main.