Do not open a public issue containing API keys, user photos, request bodies, personal information, or production logs. Use GitHub's private vulnerability reporting feature when it is enabled for this repository, or contact the project owner through a private channel.

• Keep AI credentials in .env.local or the deployment platform's secret store.
• Never place AI_API_KEY in miniapp/, browser code, screenshots, CI logs, or committed files.
• Revoke and rotate any key that appears in chat, logs, screenshots, or Git history.

Production infrastructure must not log request bodies. Any future photo persistence requires encryption, an explicit retention period, deletion controls, and renewed user consent.