Report security problems directly to a maintainer. Do not put exploit details, credentials, or user data in an issue.

Never commit credentials, access tokens, signed URLs, private media, documents, transcripts, recordings, or real user fixtures. Use synthetic fixtures and .env.example.

For the competition MVP, security fixes target main.