Stop logging generated admin passwords, redact API login usernames, confine font and file-transfer temp paths with safePath, and scope GitHub Actions permissions in build.yml.