Security overview Transport encryption, env-based secrets, and no raw creative storage on the default review path.