Do not commit AWS credentials, mail credentials, customer drawings, proprietary price books, or generated proposal artifacts. Use the ignored .factor-local directory for local evidence and deployment state, and AWS Secrets Manager for deployed secrets.

Report security concerns privately to the project owner. Do not open a public issue containing credentials, customer data, or a vulnerable production URL.