Please do not open a public issue for a suspected vulnerability or exposed credential. Use GitHub's private security-advisory reporting for this repository, or contact the maintainer privately through the repository profile.

Include a concise reproduction, affected version or commit, impact, and any suggested mitigation. Do not include real user workout data, passwords, access tokens, or provider keys in the report.

• .env, signing material, simulator session files, and automation telemetry are not accepted in commits.
• The Supabase URL and sb_publishable_ key in src/sync/supabaseConfig.ts are intentionally public client configuration; authorization must remain enforced by database RLS. A service-role key must never be added to the app or this repository.
• EXPO_PUBLIC_GEMINI_KEY is for local development only. Treat it as public if used in a client build.