Never commit API keys, access tokens, passwords, private endpoints, runtime databases, user uploads, or generated API responses. Configure external providers with deployment-platform secrets or with the ignored local JSON files documented in README.md.

The repository check rejects known real-config paths, runtime uploads, credential-like values, tracked ignored files, and files larger than 50 MiB. The Docker build context excludes local configuration and runtime state through .dockerignore.

Please report security issues privately to the repository maintainers. Do not open a public issue containing a credential, personal record, private endpoint, or reproducible exploit against a deployed instance.

Current-tree checks are not a Git-history audit. Before making a previously private repository public:

1. rotate every credential that has ever been committed or placed in an image;
2. inspect all Git history, tags, releases, artifacts, caches, and container images for secrets, runtime databases, and user data;
3. coordinate any history rewrite with every collaborator; and
4. verify the final public clone from a clean directory.