Do not open a public issue for a suspected secret-handling vulnerability. Send a minimal reproduction with no real credentials to the repository maintainer. This demo intentionally supports only synthetic/local evidence; production use requires an independently reviewed data-retention and redaction policy.