Please open a private security advisory on this repository, or email the maintainer, rather than filing a public issue.

• The only secret this project uses is a HuggingFace read token, supplied via the HUGGINGFACE_TOKEN environment variable (or an untracked local .env).
• No credentials, tokens, or keys are committed. .env and key files are listed in .gitignore, and .env.example documents the variable without a value.

• Secret scanning — gitleaks runs in CI on every push/PR (full history) and as a local pre-commit hook.
• Static analysis — bandit runs in CI over src/.
• Dependency updates — Dependabot opens weekly PRs for pip and GitHub Actions.
• Pre-commit hooks — block large files, private keys, and merge-conflict markers before they are committed.

To enable the local hooks after cloning:

pip install pre-commit
pre-commit install