Security posture Generated projects must not ship with demo secrets. Dependency policy is part of the scaffold.