DeployMesh contains instructions and templates for deployment automation. It must never contain production credentials, provider API tokens, SSH private keys, connection strings, or user data.

Please do not open a public issue for a suspected security vulnerability. Use GitHub's private vulnerability reporting feature for this repository when available. If private reporting is unavailable, contact the repository maintainer through the GitHub profile and provide a minimal reproducible description without including active credentials.

Include the affected file, the agent or provider involved, the security impact, safe reproduction steps, and a proposed mitigation if known. Redact secrets from logs and screenshots.

DeployMesh requires least-privilege authorization, idempotent operations, masked logs, immutable commit tracking, explicit confirmation before destructive production actions, and resumable handling of provider authorization gates. Installation creates symlinks and does not overwrite an existing skill unless --force is explicitly supplied.

Provider credentials must be injected through the provider's secret/config-var mechanism or a protected VPS runtime file. They must not be committed to GitHub, copied into client bundles, placed in image layers, or printed in deployment output.