Please report suspected credential exposure or code-execution vulnerabilities privately to the repository maintainers through GitHub's private vulnerability reporting feature when it is enabled. Do not open a public issue containing a secret or exploit details.

PBench executes user-supplied SQL in its external replay path. Use a dedicated, least-privilege database account and an isolated benchmark environment. Never point replay at a production database.

Credential files, .env files, private keys, and keys.txt are excluded from the source tree. If a credential has ever entered public Git history, rotate it at the provider even after removing the file.