Security
| API key security | Storage, least privilege, rotation, exposure |
| Credential data handling | What is held where, and what you should keep |
| Privacy | What the model gives you, and how to give it away |
| Production integration | Before going live |
The short version
Keep the key out of source control, out of browsers, out of query strings and out of logs. Give each integration only the scopes it uses. Assert the key's environment at startup. Store the decision, not the data.
Reporting a vulnerability
See SECURITY.md in the repository root.