TotalReclaw's full security policy — threat model, encryption details, credential-storage hardening roadmap, and how to report a vulnerability — lives at docs/SECURITY.md.

Reporting a vulnerability: please follow the process described there rather than opening a public issue.