Report security issues privately to maintainers.

Do not commit:

• API keys
• Session secrets
• Provider tokens
• Cloud credentials
• Private keys

The server is authoritative for scoring, checkpoints, captures, pickups, and finish events. Clients are not trusted for leaderboard truth.