Do not report vulnerabilities through public issues when they include secrets, private targets, generated reports, or exploit details.

For now, report security issues privately to the project maintainers after the public repository is created.

Security expectations:

• Store tokens and webhooks in environment variables or CI secret stores.
• Do not commit Playwright storageState files.
• Review crawl targets that can trigger side effects.
• Keep notification integrations optional.