Security

Protect local data and credentials

Never commit API keys, access tokens, credentials, private datasets, or personal information.
Keep secrets in environment variables or a managed secret store. Do not put them in source files, configuration, dataset manifests, logs, or checkpoints.
Review downloaded dataset rows, prompts, logs, and evaluation reports before sharing. They may contain sensitive content.
The training code does not provide a PII detector or anonymization guarantee. Dataset users are responsible for privacy review and permitted use.

Report a vulnerability

Do not publish exploitable details in a public issue. Contact the repository maintainer privately through a trusted channel associated with the repository and include a concise description, affected version or commit, impact, and reproduction steps. Do not include secret values or personal data in the report. This repository does not currently publish a dedicated security contact or response-time commitment.