To report a vulnerability or an exposed credential, email thomas@vconic.com. Do not open a public issue for anything that includes a working secret.

Local development uses the standard supabase-demo keys that ship with the Supabase CLI. Those appear in scripts and configs on purpose and are not secrets.