Do not report suspected vulnerabilities through a public issue. Use GitHub's private vulnerability reporting when available, or contact the repository owner directly.

Security-sensitive changes include authentication, authorization, tool policies, sandboxing, secrets, audit records, memory retention, tenant isolation, and dependency provenance. These changes require the high-risk review path described in docs/QUALITY_GATES.md.

Never place API keys, customer traces, prompts, memories, production data, or credentials in the repository or test fixtures.

The credentials in compose.yaml are fixed development-only values. Production deployments must inject a separate database URL through secret management, restrict the application role, encrypt connections, and run backup/restore exercises before storing customer data.