Security Policy Do not report real secrets in public issues. GitHub tokens and publishing credentials must stay server-side.