Report a security issue privately to Farhan Almutairi / CARBONFLOWS.STORE at FAR7AN.O88@GMAIL.COM. Do not open a public issue for a suspected credential leak or an unpatched vulnerability.

• No OpenAI API key, GitHub token, private signing key, password, or production secret is required in the repository.
• Optional OpenAI credentials are read from OPENAI_API_KEY at runtime and must be supplied through the environment or a secret manager.
• Live evidence uses a synthetic canary and an in-memory sink. It does not read or transmit a production credential.
• Runtime signing keys are generated under ignored working directories and must not be committed.

On 18 July 2026, the complete working tree was scanned with Gitleaks v8.30.1 using redacted output. Generated demo signing keys found under the ignored demo/_run/ directory were removed, then the scan was repeated with no leaks found. A separate pattern scan found no OpenAI, GitHub, AWS, Slack, Google, or PEM private-key credential in the publishable tree.

This audit covers the repository contents at publication time. It is not a guarantee that future changes are secret-free; rerun secret scanning before every release.