Never commit API tokens, SSH passwords, private keys, or populated environment files.

Use environment variables and keep local values in an ignored .env file. The tracked .env.example contains names and non-secret defaults only.

If a credential has ever appeared in Git history, revoke and rotate it before attempting history cleanup. Removing the current file alone does not invalidate the exposed credential.

The example services are intended to bind to 127.0.0.1. Do not expose the Actor, Normalizer, Verifier, or CPRet endpoints directly to the public internet without authentication, rate limits, request-size limits, and network access controls.

Report security issues privately to the repository maintainers. Do not include active credentials or sensitive generated data in a public issue.