Do not commit API keys, passwords, company accounts, customer information, or personal data. Do not disclose sensitive details in a public Issue. Report security or secret-exposure concerns privately to the repository owner.