# Security Policy

## Scope

This repository contains public-safe architecture documentation and sanitized examples only. It does not accept production credentials, raw infrastructure exports, private topology, or personal data.

## Reporting a problem

If you find sensitive information in this repository:

1. Do not quote it in a public issue.
2. Contact the repository owner through an already established private channel.
3. Include only the affected path and the type of exposure until the value has been revoked.

A confirmed credential exposure is handled by rotating the credential first, removing it from current files, rewriting affected Git history, and verifying a fresh clone.

For the full repository policy, see [docs/security.md](docs/security.md).