Report suspected credential leaks or security vulnerabilities privately using GitHub private vulnerability reporting. Do not include IBKR tokens, Ghostfolio credentials, account identifiers or real transaction exports in public issues or pull requests.

Security fixes target the current main branch. Older releases do not receive separate backports. Dependency and image security checks run on pull requests and weekly. Merging a fix validates the change. Release publication is a separate step. Infra owns managed production deployment and image pins.