Do not include account cookies, access tokens, keystores or passwords in reports. Repository signing secrets belong in GitHub Actions secrets. Only trusted maintainers may alter publishing workflows. Source changes execute build scripts with release credentials on main; review workflow and dependency changes accordingly.