Please report security issues privately using GitHub's private vulnerability reporting on this repository ("Security" tab → "Report a vulnerability").

Do not open a public issue for security reports.

• Never commit a real .env, database dump, or Solana keypair. *.dump and keypair JSON files are gitignored.
• The recipes table stores mint/transfer wallet secret keys. Anyone with a copy of the database can sign as those wallets. Protect database credentials and backups accordingly, and keep the amount of SOL/assets held by recipe wallets to the minimum needed for operations.
• Rotate PAYER_KEY, RPC API keys, and UPLOADTHING_TOKEN if they are ever exposed.