Best practices

Pull requests, nightly scans, release archives, false positives, and credentials.