SECURITY.md

# Security Policy

Found a vulnerability? Please report it privately — open a GitHub issue
without exploit details in the public text, or message the bot owner directly.

Helpful reports include: where (file and line), what an attacker could do,
and how to reproduce it in a test environment. Never send live keys or tokens.

Secrets in `.env` and environment variables are never committed (see
`.gitignore`). If a key has leaked, say so directly and it will be rotated.