Do not commit .env*, Vercel credentials, Solana private keys, GitHub tokens, or mailbox credentials.

The production deployment should receive secrets only through Vercel environment variables.

AgentVault checks Solana USDC transfer signatures and keeps a receipt registry to reduce replay risk. Production integrations should use finalized transactions and should not trust client-side payment claims.

Open a GitHub issue with:

• affected endpoint
• expected vs actual behavior
• minimal request/response example
• whether funds or credentials were involved

Do not paste secrets into public issues.