Do not commit Hugging Face tokens, W&B keys, cloud-drive links, model-provider credentials, private datasets, or generated model weights. Use runtime-managed environment secrets and review logs before sharing them.

Please report code vulnerabilities privately through GitHub's security-advisory feature.