Please report security vulnerabilities privately. Do not open a public GitHub issue, pull request, or discussion for a suspected vulnerability, as that discloses the problem before a fix is available.

Instead, report it through one of:

• GitHub's private Security Advisories (preferred): open the repository's Security tab and choose Report a vulnerability.
• Email: security@example.com

Please include:

• A description of the vulnerability and its impact.
• Steps to reproduce, or a proof of concept.
• Affected version(s) or commit, and your environment.
• Any suggested remediation, if you have one.

• We aim to acknowledge your report within 3 business days.
• We will investigate, keep you updated on progress, and let you know when a fix is released.
• We practice coordinated disclosure: please give us a reasonable window to ship a fix before any public disclosure. We are happy to credit you once the issue is resolved, unless you prefer to remain anonymous.

Security fixes are applied to the latest release line. While the project is at 0.x, only the most recent minor receives fixes.

This service is gated by consumer API keys (API_KEYS) and holds upstream provider credentials (Comic Vine, Metron, Marvel, SuperHero) in its environment.

• Never commit secrets. API keys, provider credentials, and .env files must never be committed. .env is git-ignored; only .env.example (with placeholders) belongs in version control.
• Treat API_KEYS and all provider credentials as sensitive. Rotate any key that may have been exposed, and rotate the sample dev-key-123 before any non-local deployment.
• Configuration is supplied through environment variables only; prefer a secrets manager over plaintext files in production.
• If you discover a leaked credential in the repository history, report it through the private channel above so it can be rotated and purged.

Thank you for helping keep this project and its users safe.