Security Review

Required Checks

No credentials, tokens, cookies, API keys, private keys, or session files.
No private user data, dumps, card data, logs, or captures that should not be stored.
No copied dependency trees where package managers or SDK installers should be used instead.
No unexplained binaries in source history.
Risky behavior is documented and scoped to authorized lab use.

A release is blocked until the checklist is complete or a maintainer explicitly records why the item does not apply.