# Security

Do not commit API keys, customer prompts, private media URLs, or task outputs. Report vulnerabilities privately through the repository security advisory flow. Live requests require an explicit `--execute` flag and `APIMART_API_KEY` environment variable.
