Please do not report security-sensitive issues in public pull requests. Send them privately to the project maintainers with a description of the affected file, impact, reproduction steps, and a suggested mitigation when available.

Never commit credentials, private dataset records, model weights, checkpoints, or generated logs. If a secret is committed accidentally, revoke it first and then report the incident privately; removing it from a later commit does not make the secret safe.