# Security Review
<!-- stewardship-standard: security-review-v1 -->

## Required Checks

- [ ] No credentials, tokens, cookies, API keys, private keys, or session files.
- [ ] No private user data, dumps, card data, logs, or captures that should not be stored.
- [ ] No copied dependency trees where package managers or SDK installers should be used instead.
- [ ] No unexplained binaries in source history.
- [ ] Risky behavior is documented and scoped to authorized lab use.

## Release Gate

A release is blocked until the checklist is complete or a maintainer explicitly records why the item does not apply.