Please report security issues privately through GitHub's Report a vulnerability feature rather than opening a public issue. Include the affected file, reproduction steps, and likely impact.

This repository must never contain:

• Hugging Face or API tokens;
• .env files;
• the secret blinding/review key;
• private key-custody material; or
• local collection-authorization artifacts.

If a secret is committed, revoke or rotate it immediately and remove it from Git history. Rewriting history alone does not make an exposed credential safe.

The offline tests do not authorize model inference. Locked collection requires the separately reviewed procedure described in LOCKED_COLLECTION_RUNBOOK.md.