Do not disclose vulnerabilities publicly. Contact the repository owner privately with affected versions, reproduction steps, and impact. Never include real credentials or account data.

Evidence is encrypted at rest by default and isolated by user. Containers run as a non-root user. Production CORS origins must be explicit. Error responses avoid keys, local paths, and stack traces. Paper mode and LIMIT orders remain enforced.

Secrets belong in the deployment platform, never source control, images, logs, or reports. The offline audit complements rather than replaces platform secret scanning, dependency review, and container scanning. Security updates currently target the latest alpha.

Dashboard authentication behavior and deployment limitations are documented in docs/SECURITY.md.