If you discover a security vulnerability in Locsight, please report it responsibly:

1. Do NOT open a public issue
2. 📧 Email: Create a private security advisory
3. Include:
   • 📋 Description of the vulnerability
   • 🔄 Steps to reproduce
   • 💥 Potential impact
   • 💡 Suggested fix (if any)

Locsight includes a built-in Secrets Scanner that detects:

• 🔑 AWS Access Keys
• 🐙 GitHub Personal Access Tokens
• 🔍 Google API Keys
• 🔒 Private Keys (RSA, DSA, EC)
• 🧮 High-entropy strings (potential passwords/tokens)

⚠️ All detected credentials are automatically masked before display. Only partial prefix/suffix is shown.

• 🚫 Never commit secrets to source control
• 📄 Use .analyzer.json to exclude sensitive directories
• 🔐 Add sensitive files to .gitignore
• 🔄 Rotate any exposed credentials immediately

_{🛡️ Security is a shared responsibility. Thank you for helping keep Locsight safe.}