Never commit secrets to GitHub (or any remote).

Open a GitHub Security Advisory on this repository, or contact the project maintainer. Do not publish exploits in public issues until a fix is available.

• .env and variants (except .env.example)
• deploy/*.env with real secrets (except *.env.example)
• .secret_key and production PDF_EDITOR_SECRET_KEY / PDF_EDITOR_AUTH_TOKEN values
• Contents of uploads/ (user documents)
• TLS private keys (*.pem, *.key) and certificates with private material

• .env.example with empty placeholders or change-me-...
• Documentation of required variables
• Application code without embedded credentials

• Prefer binding behind a reverse proxy with TLS for any non-trusted network.
• Optional token auth (PDF_EDITOR_AUTH_ENABLED=1 + PDF_EDITOR_AUTH_TOKEN) is a minimal hook — not a full multi-user ACL.
• Uploaded files are temporary working data; default cleanup removes sessions older than PDF_EDITOR_TEMP_HOURS.

1. Rotate the secret immediately (PDF_EDITOR_SECRET_KEY, auth token, TLS keys, etc.).
2. Revoke affected tokens.
3. If it was already pushed to GitHub: treat the commit as compromised; scrub history or rotate and assume exposure.
4. Notify the project maintainer.