Please report suspected security vulnerabilities to <PLACEHOLDER — security contact / mailing list>. Do not open a public issue for security reports. You will receive an acknowledgement within <PLACEHOLDER — SLA, e.g. 3 business days>.

• Secrets are never stored in Git. Pre-commit (gitleaks, TruffleHog) and a Prow presubmit enforce this at commit time and in CI.
• Runtime secrets are supplied via an external mechanism (e.g. External Secrets Operator or Sealed Secrets) — never committed manifests.
• If a secret is accidentally committed, rotate it immediately; rewriting history is not a reliable remediation.

Dependabot (.github/dependabot.yml) tracks dependency and GitHub Action updates. Security patches are prioritized for merge.