Please do not report vulnerabilities in a public issue.

Use this repository's private vulnerability reporting form under the Security tab. Include a concise description, reproduction steps, and the affected SDK version. Do not include real candidate data, resumes, API keys, access tokens, or webhook secrets.

API keys should be stored in a secret manager and supplied to applications at runtime. They must never be embedded in frontend code or committed to source control.