Security fixes are applied to the latest release and main. Generated collections should be pinned to a released tag or commit when used in automation.

Do not open a public issue for a suspected vulnerability, leaked credential, customer-data exposure, unsafe generated request, or authentication-boundary problem. Use GitHub private vulnerability reporting.

Include the affected file, release or commit, impact, and a minimal reproduction that contains no real credentials, customer data, signals, trades, account identifiers, broker details, or production logs.

• The committed hosted environments intentionally contain an empty apiKey value.
• Add hosted credentials only in Postman's local/current secret value or Bruno's secret-variable store.
• Never place a hosted key in a collection variable, shared environment value, issue, test fixture, screenshot, or CI log.
• The local mock sentinel is synthetic and is refused by the Postman collection when paired with the hosted base URL.
• If a real credential is exposed, revoke it at the provider before reporting the repository issue.

The bundled mock is test tooling and listens only on loopback. It is not a sandbox service, authentication authority, webhook receiver, trading engine, broker connector, or production substitute.