# Security reporting

Report suspected vulnerabilities privately through [Trade It support](https://tradeit.app/contact). Include the affected surface, expected and observed behavior, and sanitized reproduction steps.

Do not post access tokens, API keys, private keys, brokerage credentials, or personal account data in public issues. If a credential was exposed, revoke or rotate it through its issuing service and report the exposure privately.

This repository distributes plugin and registry metadata and agent guidance. The hosted Trade It service handles authentication, account permissions, and brokerage operations. Identify whether the issue affects packaging, assistant guidance, or the hosted service when reporting it.