Do not commit secrets, credentials, customer data, or raw production extracts to spec artifacts.

Before publishing to Jira or Confluence, redact sensitive SQL, PII samples, environment credentials, and private endpoint names that are not required for review.

Report security issues privately through the repository security advisory flow.