Please report vulnerabilities through GitHub's private Report a vulnerability flow on this repository's Security tab when that option is available. Do not include exploit details, credentials, account IDs, customer data, or private asset URLs in a public issue.

If private vulnerability reporting is unavailable, open a minimal public issue that asks the maintainers to establish a private channel. Include no sensitive technical details in that issue. This repository does not publish a private security email address, so this policy does not invent one.

In a private report, include:

• the affected file, command, or workflow;
• the impact and prerequisites;
• minimal reproduction steps using placeholders or test accounts;
• whether any credential or live account may have been exposed; and
• a proposed remediation, if you have one.

Do not test against accounts, assets, ad spend, or vendor infrastructure you do not own or have explicit permission to use.

Security fixes target the latest code on the repository's default branch. Older snapshots and generated .cursor/skills/ mirrors are not maintained separately; re-sync the mirror after updating canonical skills.

• Copy .env.example to .env and put real values only in .env. The example file must contain placeholders only.
• Keep .env ignored by Git and restricted to the local user (chmod 600 .env on Unix-like systems).
• Prefer environment variables or .env loading. Never put Arcads or Meta credentials in command-line arguments, prompts, issue reports, screenshots, fixtures, or committed files.
• Treat ARCADS_BASIC_AUTH as a secret even though it is encoded. Base64 is not encryption.
• Grant Meta tokens only the permissions and account access required for the intended workflow.
• Treat MASTER_CONTEXT.md, references/, outputs/, and local API logs as potentially sensitive. They can contain account identifiers, performance data, people, product assets, generated-asset URLs, or campaign provenance.
• Review git status and the staged diff before publishing changes.

If a credential may have been exposed, revoke or rotate it with the provider immediately. Removing a file from the latest commit does not remove it from Git history, forks, logs, or caches.

For the initial public release, publish only the reviewed snapshot into the new clean-history repository. Do not change the private source repository's visibility or push its refs/history to the public destination.

PAUSED-by-default is an accident-prevention control, not a substitute for account security or operator review. This repository creates Meta campaigns, ad sets, and ads as PAUSED. A real activation is a separate mutation and the status tool requires both --execute and the exact --confirm ACTIVATE confirmation.

Before any live Meta operation, confirm the token, ad account, entity hierarchy, destination URL, budget, and requested status. Use dry-run or preview modes first. Never use live generation, scraping, or Meta mutations as a routine security test.

Arcads, Meta, Selenium-driven websites, and other vendors have their own security and acceptable-use policies. A vulnerability in a third-party service may need to be reported to that provider as well as to this repository when the integration contributes to the issue.