Never commit API keys, tokens, .env files, private keys, credentials, personal information, client data, or non-public datasets. Use .env.example files with placeholder values.

To report a vulnerability, do not open a public issue with exploit details or secrets. Contact the DSRP maintainers through a private channel listed by the organization, including a clear reproduction and impact summary. They will acknowledge the report, assess it, and coordinate disclosure.