Do not open a public issue containing credentials, tokens, personal data, or exploit details. Contact the repository owner privately with a concise reproduction, affected route or package, impact, and suggested mitigation.

SearchSignal is a synthetic demonstrator and reference implementation. It contains no merchant catalog data or production provider credentials. Its production-search route fails with a sanitized unavailable response when live provider configuration is absent; it does not fall back to synthetic data.

The project does not claim production SaaS readiness, compliance certification, or a live merchant integration. See the detailed security baseline and deployment environment reference.

• Never commit secrets, tokens, private URLs, customer data, or raw production catalogs.
• Keep provider credentials server-only and never use NEXT_PUBLIC_ for secret-shaped values.
• Preserve validation and sanitization boundaries; do not weaken them to accommodate fixtures.
• Report dependency or runtime concerns through the process above.