This repository contains research workflow automation, dashboard code, and paper-trading infrastructure. It should be treated as a development and research system, not as a production brokerage system.

Security-sensitive areas include:

• credential loading and environment-variable handling
• broker integration code
• local scheduler / automation entry points
• any code that can place, cancel, or sync paper-trading orders
• runtime result stores and local databases

Please do not open a public GitHub issue for security-sensitive findings.

If you discover a vulnerability, report it privately to the repository owner with:

• affected file or module
• reproduction steps
• impact assessment
• suggested mitigation if available

Until a private security contact address is published, use a direct private channel with the maintainer instead of public issue threads.

Do not post any of the following in public:

• API keys, tokens, or cookies
• broker credentials
• private endpoints or internal host configuration
• local database contents
• unredacted screenshots containing account state or order history

Contributors should never commit:

• .env files
• raw credentials
• local runtime databases
• result snapshots containing private account or broker state

Before opening a PR, verify that:

1. no credentials were added to tracked files
2. no local runtime data was committed
3. sample commands use placeholders or environment variables instead of personal machine paths

Security fixes may be prioritized over feature work. Response time is best effort until a formal maintenance SLA is published.