Do not open a public issue containing an API key, receipt, OCR response, source image, returned cutout, billing identifier, or personal data. Use the private security-reporting channel configured for the repository host. Revoke an exposed key before reporting it.

• BRAINIALL_API_KEY is the only accepted secret. It is read from the process environment only, attached to one in-memory request, and never printed, written, returned from a helper, or embedded in an error.
• Network access requires both --live and the exact --rightsAndConsent=true flag. Consent is not inferred from a file path.
• There is one request per invocation, no automatic retry, redirect, callback, telemetry, analytics, queue, or persistence.
• Source images, full OCR payloads, full OCR text, and returned image bytes are held only in memory for the current process. The examples never write them.
• Offline fixtures are tiny synthetic data. Never replace them with real receipts, customer files, faces, products, keys, or production responses.
• HTTP status, content type, response size, JSON/base64 schema, timeout, arithmetic, PNG structure, CRC, dimensions, alpha, confidence, and requested coordinates fail closed.

The examples are not a browser integration. Putting a provider key in client JavaScript, a mobile bundle, logs, crash reports, or source control is outside the security model.