Security

Public release guidance for secrets, permissions, logging, and generated code.

Never commit real API keys, tokens, or connection strings. Use environment variables or a secret manager.

Ask before ingestion, web requests, file reads, API calls, and cloud connections.

Keep file, URL, and API allowlists narrow for agentic tools.

Use structured logs and redact sensitive values before writing them.

Write placeholders into .env files, not live secrets into Python.

Pin production dependencies and review optional extras before release.

For the repo-level checklist, see SECURITY.md.