Do not commit access tokens, production credentials, raw biometric material, unencrypted private media, or unredacted message content. Reproduce security failures with synthetic fixtures. Pull-request jobs must be credential-free; private cross-organization integration uses the organization-managed TEST_FLEET_READ_TOKEN only in gated workflows.