Do not commit API keys, webhook URLs, cookies, database dumps, personal data, or production .env files.
If you discover a security issue, open a private advisory or contact the maintainer privately. Avoid publishing exploit details until a fix is available.