# Security

Capability Kit examples must default to local fakes, least-privilege grants, explicit approvals, typed receipts, and cleanup. Do not place credentials, tokens, customer data, prompts, private logs, or private provider URLs in public source artifacts.

Report suspected leaks to support@continua.ai.