# Security Policy

- Keep secrets only in environment variables or encrypted database settings.
- Use HTTPS, secure cookies, CSRF protection, rate limiting and private attachment storage.
- Never expose stack traces or confidential payloads in production logs.
- Validate MIME type, extension, size and access policy for uploads.
- Apply branch and role policies to UI, exports, APIs, queues and AI tools.
- Verify webhook signatures and use idempotency keys for financial API requests.
- Report vulnerabilities privately to the project owner; do not include production data.
