If you find a security issue, report it privately to the project maintainer instead of opening a public issue with sensitive details.

Never commit:

• .env or other local environment files
• API keys
• tokens
• cookies
• email passwords
• private local paths
• real external project configuration

Use .env.example for placeholders only.

Do not commit:

• real diary entries
• generated diary feedback
• summary cache files
• databases
• logs
• serialized local data
• real desktop-pet bridge files

If a directory is needed for runtime output, keep the real contents ignored and publish fictional examples only.

External integrations must be optional, configurable, and disabled by default. Do not hardcode real local paths, ports, tokens, or generated bridge data.

Smart Desktop Pet bridge files should contain only sanitized summary data, not full diary text, raw AI conversations, or private memories.

If a key, token, password, or private credential is committed:

1. Revoke or rotate it immediately.
2. Remove it from the working tree.
3. Clean it from Git history before publishing.
4. Confirm the new secret is stored only in .env or another ignored local file.

If sensitive personal data has entered Git history, clean the history before making the repository public.