Report vulnerabilities privately to contact@maximkuzlin.com. Include the affected version, reproduction steps, and impact, but never include account passwords, session keys, signing credentials, or personal listening history.

• Never commit Configuration/Secrets.xcconfig.
• Never commit reviewer credentials, Last.fm session keys, Apple signing keys, provisioning profiles, archives, or exported application packages.
• Use only placeholders in Configuration/Secrets.xcconfig.example.
• User Last.fm session keys and usernames are stored in Keychain and are not logged.
• HTTPS protects Last.fm API transport.

Last.fm's desktop signing protocol requires a shared secret in a distributed client. Keeping it outside Swift and source control prevents repository disclosure, but cannot make a value embedded in a shipped binary cryptographically private. Judge and production builds should use separate, revocable Last.fm API applications. See Docs/LASTFM_SETUP.md.