Do not commit Wi-Fi credentials, WhatsApp credentials, API tokens, device provisioning secrets, or private keys. Use environment variables, device provisioning, and the deployment secret manager.

Report vulnerabilities privately through GitHub Security Advisories for the most relevant repository. Include affected versions, impact, reproduction steps, and a suggested mitigation when available.