# Security policy

## Sensitive information

Do not commit API keys, access tokens, broker credentials, passwords, account IDs, personal contact details, local trade journals, user portfolios or downloaded statement PDFs. The repository ignores `.env`, local config files and `marketpilot/state/` by default.

Core functionality has no mandatory API keys. SEC EDGAR requests use a local `SEC_USER_AGENT` environment variable. Set it in your shell or secret manager; do not paste it into a model chat and do not commit the real value.

## Reporting a vulnerability

Do not publish secrets, live account data or exploit details in a public issue. Contact the repository maintainer through a private channel configured on the GitHub repository. Remove or rotate any secret that has been committed or pasted into a shared environment; deleting a visible file or message alone may not revoke it.

## Trading boundary

v1.0.0 has no live broker adapter. Any future proposal to add order routing must be reviewed separately for authentication, key isolation, explicit approval, auditability, rate limits, failure handling and applicable laws before implementation. Do not add a live endpoint as a quick fix.