DumbMoney is public source with private, local-first runtime state.

Report a suspected vulnerability through GitHub's private vulnerability reporting for ObtuseAI/DumbMoney when available. Do not open a public issue containing credentials, exploit details, account data, or a live bypass.

If exposure may involve a real credential, revoke or rotate it before further operation. A repository report is not a substitute for securing the affected account.

Never commit:

• broker, model-provider, or data-provider credentials;
• browser profiles, cookies, refresh tokens, or session databases;
• account history or private market data;
• private keys or credential-store exports;
• live runtime databases, imports, logs, backups, or deployment receipts;
• signed operator authority or local capital configuration.

Use the ignored .dumbmoney/, runtime/, artifacts/, and local secret-store paths documented by the runtime. Keep status services on loopback.

Public visibility does not grant live-trading or target-mutation authority. Treat every clone as research-only until identities, release hashes, evidence, reconciliation, policy, credentials, and explicit operator authority are independently established.

The repository source does not itself authorize an order, strategy promotion, containment action, credential action, or deployment.