Security Policy Reporting a Vulnerability Open a private security advisory on GitHub; do not share secrets publicly. Secrets Use env vars and Key Vault; never commit credentials. CI/CD Controls SAST (Bandit), dependency audit (Safety), code review via PRs.