Security

• Persist it
• Log it
• Cache it in application code
• Include it in analytics
• Include it in error-reporting payloads
• Send it to third parties

Any exception requires a documented feature need, explicit user understanding, an accepted architecture decision, and a defined retention and deletion policy.

Logs may include a timestamp, request ID, HTTP method, route, status code, duration, and other safe operational metadata. Logs must never include raw tool content, authorization headers, cookies, credentials, tokens, private keys, certificates containing private material, environment files, or sensitive configuration values.

Every public processing endpoint must:

• Validate request shape and tool content
• Enforce payload limits
• Reject malformed input safely
• Avoid dynamic or shell execution
• Return safe errors without exposing a stack trace

Do not open a public issue for a vulnerability that could put users or infrastructure at risk. GitHub’s Private Vulnerability Reporting requires GitHub Advanced Security, which isn’t available on this repository’s current plan while it’s private — there is no confidential reporting channel set up yet. If you find something you believe is sensitive, hold off on public disclosure; a dedicated channel will be published here once one exists.