Security Security expectations for CarePilot. Baselines Do not store secrets in repo. PII access must be minimized and auditable. Auth/session changes require explicit review.