Do not open a public issue for a suspected credential leak, code-execution vulnerability, or other report that would increase risk if disclosed. Use GitHub's private vulnerability reporting feature for this repository. If that feature is unavailable, contact an AI45Lab repository maintainer privately.

Include the affected path or component, reproduction conditions, likely impact, and any suggested mitigation. Do not include live credentials or hazardous generated content in the report.

The repository expects API credentials through environment variables such as OPENAI_API_KEY and SERPER_API_KEY. Never commit real keys. Keep generated responses, reports, logs, prompt traces, and newly retrieved search evidence out of Git unless they have been reviewed and intentionally prepared for release.

If a real credential is ever committed or exposed in an artifact, revoke or rotate it immediately. Removing it from a later commit is not sufficient.