Do not include passwords, access tokens, complete connection URLs, production data, or credential-bearing driver exceptions in issues or logs. Use SecretRef.env("NAME") when a password should be resolved separately in each process.

Report suspected vulnerabilities privately to the project maintainers before public disclosure.