Security Policy Report vulnerabilities to [email protected]. Never commit secrets; use repository secrets for tokens.