Security Policy Please report vulnerabilities or suspicious behavior privately via email before filing public issues. Include reproduction details, logs (with secrets redacted), and suggested impact assessment. You will receive acknowledgment within 72 hours and status updates until remediation. Production secrets (Pushover, Gmail, NewsAPI, PAT) are stored as GitHub Actions secrets; never commit secrets to the repo.