15. Best practices

PR gates, nightly scans, release archives, false-positive handling, and credential hygiene.