Security

Report carefully. Do not paste real secrets into a public ticket.

Use lab canaries from the repo for reproduction, not production tokens.