If you discover a security issue, please report it responsibly:

1. Preferred: Open a GitHub Security Advisory (private report).
2. Alternative: Email the maintainer via GitHub (see repository owner profile).

Please include steps to reproduce, affected versions, and impact if known. Do not open public issues for undisclosed vulnerabilities.

Security fixes are applied to the default branch (main). Older tags may not receive backports unless noted in release notes.

• Never commit .env, candidate.json, storage_state.json, or files under data/.
• Rotate API keys and SMTP credentials if you suspect they were exposed.
• EC2 deployments should store secrets in AWS SSM Parameter Store (see deploy/README.md).