Never commit CDP API keys, private keys, production identifiers, or customer data. Use environment variables or an external key file.

Report suspected vulnerabilities through Coinbase's HackerOne program. Do not disclose vulnerabilities in a public issue.