# GAL-2 Time Contract RC3.1 Security Notes

Do not place secrets in logs, screenshots, public repositories, public issue reports, or support tickets.

Sensitive values include:

- GAL2_API_KEY
- API tokens
- passwords
- private signing keys
- customer credentials
- regulated data
- internal infrastructure URLs
- proprietary customer logs

Recommended API key handling:

- store API keys only in /etc/gal2/daemon.env
- set permissions to 600
- run as root only when required for service management
- rotate keys if exposed
- never paste keys into public chat, GitHub, screenshots, or terminal recordings

If you believe you found a security issue, contact GAL-2 Technologies LLC privately before public disclosure.

This evaluator release does not include GAL-2 protected core logic, private signing keys, customer API keys, or protected formula materials.
