Please do not open a public issue for vulnerabilities involving credentials, dependency compromise, arbitrary code execution, or unauthorized exchange access. Use GitHub's private vulnerability reporting feature when available.

Include the affected version, reproduction steps, impact, and a suggested fix if known. Never include real API keys or account data.

Security reports may cover source code, dependency configuration, CI workflows, credential handling, and exchange integrations. Trading losses, market volatility, and model accuracy are not security vulnerabilities.