Do not open a public or broadly visible issue containing credentials, exploit details, private network information beyond what is already documented, or sensitive research data.

Contact a lab administrator through the established private lab channel. Include:

• what was observed and when, including timezone;
• the affected account, service, or path;
• the minimum sanitized evidence needed to reproduce or assess it;
• any containment step already taken.

If a password, API token, SSH private key, or other credential may have been exposed, stop using it and request rotation. Deleting it from the latest Git revision does not remove it from history.

This repository is intentionally public so lab members can access the usage guide without a GitHub invitation. The documented SSH endpoint and host-key fingerprint are therefore public information; possession of them does not grant a server account.

Keep infrastructure detail to the minimum required for normal use. Configuration files, credentials, private network topology, security-event evidence, and administrator-only procedures that would materially weaken the server must not be published here.

Never add:

• passwords or password hints;
• private SSH keys or unredacted SSH configuration containing secrets;
• access tokens, cloud credentials, or .env files;
• participant-identifiable or otherwise sensitive research data;
• unreviewed instructions that weaken authentication or expose a service publicly.