Do not open a public issue containing credentials, customer data, private logs, or vulnerability details.

Report suspected vulnerabilities through GitHub private vulnerability reporting. Include the affected version, impact, and a minimal sanitized reproduction. For other private security questions, use the MemorySync contact route.

If an API key is exposed, revoke it immediately. Keep keys in server-side environment variables, use a dedicated project and least-privilege credentials, and rotate keys used for local testing.