If you find a security issue, please do not open a public issue. Email jawaharnaidu07@gmail.com with details and steps to reproduce. I'll respond as soon as I can.

• All credentials live in .env, which is git-ignored — never committed.
• config.py reads everything from environment variables; no keys are hardcoded.
• If you fork or clone, copy .env.example → .env and supply your own keys.
• If a key is ever exposed, rotate it immediately (Anthropic console / BotFather).