Never commit tokens, keys, production user data, biometric evidence, private messages, recordings, or unpublished provider credentials. Report vulnerabilities privately to the production owner.