CineLark handles provider credentials and capability-bearing playback URLs. Treat both as secrets.

• HAR/network capture files or extracted captures
• usernames, passwords, TOTP values, cookies, or access tokens
• URLs containing token, auth, key, signature, or equivalent query data
• unredacted account, subscription, or viewing-history responses
• production Keychain exports, bridge secrets, Remote pairing QR payloads, or device credentials
• release-signing private keys, PKCS#12 archives/passwords, or Homebrew tap access tokens

Only synthetic fixtures belong in fixtures/.

• Store provider and bridge secrets in macOS/iOS Keychain.
• Redact authorization headers, cookies, and sensitive query parameters before logging or telemetry.
• Keep provider credentials in the core app; never send them to IINA or mpv.
• The IINA bridge declares file-system only because stock IINA gates core.open behind it even for network URLs; bridge code must not use that permission to read or write user files.
• Treat playback and download URLs as short-lived bearer capabilities. Resolve them just in time and expose them to the clipboard or browser only after an explicit user action.
• Persist only recreatable metadata in the versioned Application Support cache; never cache credentials, tokens, signed URLs, or playback descriptors.
• Clear account-scoped metadata before a new provider sign-in and keep cache directories/files restricted to the current user.
• Authenticate every local bridge connection and message.
• Protect Remote traffic with TLS, certificate pinning, explicit pairing, and revocable device-scoped credentials.
• Do not ship the current IINA WebSocket transport until its network exposure and pairing design satisfy the constraints in docs/interfaces/playback-bridge.md.
• Treat the self-signed release identity as durable security infrastructure: keep it outside the repository, restrict CI access, and preserve it across releases so Keychain designated requirements remain stable.
• Project Homebrew releases are not Apple-notarized. The custom Cask pins their SHA-256 digest and removes quarantine; it does not provide Apple's malware scanning, identity validation, or certificate revocation.

Until a private reporting channel is published, contact the maintainers without including secrets or exploit details in a public issue.