# Reporting Security Problems

Do not include API keys, real credentials, personal data, or live target
details in an issue, email, screenshot, dataset, or manuscript.

For an internal defect, record:

- component and version;
- synthetic scenario ID;
- expected and observed fail-closed behaviour;
- redacted event identifiers;
- whether the sandbox state changed;
- a minimal safe reproduction using only synthetic assets.

Rotate a key immediately if exposure is suspected. A key value must never be
copied into a report.

