Report security problems directly to a maintainer. Do not put exploit details, credentials, or user data in an issue.

Never commit credentials, tokens, signed URLs, private media, documents, transcripts, prompts, or provider responses. Use synthetic fixtures and .env.example.

For the competition MVP, security fixes target main.