Please do not open public issues for security vulnerabilities.

Use GitHub private vulnerability reporting for this repository, or contact the maintainers privately if that is unavailable. Include enough detail to reproduce the issue, but do not include real client documents, API keys, or secrets.

For local testing, use disposable Supabase projects, storage buckets, and model provider keys. See docs/safe-local-testing.md.