Do not commit credentials, live account responses, device identifiers, APKs, downloaded analysis engines, or browser session state. Use accounts and devices you control.

App workbenches with authentication or request execution must document their own security boundaries. See the Instagram security notes for the existing local server and browser helper.

Report security issues through GitHub private vulnerability reporting when available. Include synthetic reproduction steps; never post account data or secrets publicly.