Do not open a public issue for a vulnerability, credential, private dream, or other sensitive data.

Report security concerns privately to rahim@mydreamthreads.xyz with the affected endpoint, expected impact, and a minimal reproduction that contains no real dream text or personal information.

Partner keys must stay in a server-side secret manager. If a key may have been exposed, stop using it and request rotation immediately.