Email support@projectalpha.tech with a clear description and steps to reproduce. Do not open a public issue for sensitive reports.

• Never commit API keys, .env, training corpora, or private benchmarks.
• Provider keys are read from the environment only.
• Coding-agent writes require explicit approval inside the CLI.
• Workspace paths are bounded; do not treat ALPHA as unrestricted shell access.