Wapentake is a local Mac development preview. Keep conversation state, source captures, capabilities, model configuration and credentials outside the repository and release artifacts.

Report a vulnerability privately to the repository owner through GitHub's private vulnerability reporting when available. Do not include real tokens, session URLs, credentials or conversation captures in issues or pull requests. A minimal synthetic reproduction is preferred.

The development controls describe secret scanning, dependency checks, review requirements and draft releases. Application trust boundaries and current evidence are documented in verification.