Report vulnerabilities privately to the repository owner. Do not open public issues with credentials, tokens, Firebase configuration, cloud account identifiers, or exploit details.

Never commit:

• .env
• provider API keys
• Firebase service account files
• JWT signing keys
• AWS credential config files
• server PEM files
• production database dumps
• production logs

Use .env.example and clientLibraryConfig-aws-provider.example.json for placeholders only.

When ENVIRONMENT=production, production values should come from a managed secret store or secure runtime environment. DATABASE_SECRETS_NAME must point to the database secret used by AWS Secrets Manager.