Public security review

Last reviewed: 2026-07-24

The repository was reviewed before its public launch:

• gitleaks dir . reported no findings after placeholder cleanup.
• gitleaks git . reported ten historical matches. Manual review classified them as example authorization headers, synthetic test values, placeholder configuration values, and Git author email addresses.
• trufflehog git file://... --only-verified reported zero verified secrets.
• No .env, .env.local, customer data, private screenshots, or employer/client source material is tracked.

The historical findings do not contain verified credentials and do not justify a disruptive history rewrite. If a real credential is ever discovered, revoke it first, remove it from the current tree, and then evaluate history cleanup.

Local credentials belong in .env or an MCP client's local configuration. Never paste a credential into an issue, pull request, fixture, screenshot, or log.