Report vulnerabilities privately to the repository maintainers through GitHub Security Advisories. Do not open public issues containing credentials or exploit details.

Meterboard's API can store third-party credentials. The public demo stores none. Production operators must use a random 32-byte base64 CREDENTIAL_ENCRYPTION_KEY, TLS, WorkOS authentication, a dedicated database login allowed to switch only into meterboard_app, forced Supabase Row Level Security, and isolated provider keys with minimum documented permissions. Secrets must not be placed in Vercel public environment variables or committed files.