Sky Cache stores values only in the memory of the current process. It should be treated as an ephemeral cache, not as a secret store or durable database.

• enable CACHE_API_TOKEN when exposing the HTTP boundary outside a trusted network
• terminate TLS at a trusted reverse proxy or service mesh
• do not cache plaintext credentials, private keys, regulated data, or other material that requires durable encryption controls
• apply network-level access control and resource limits in the deployment environment
• restart the service to clear all cached values when a full purge is required

• bounded key length and value size
• bounded maximum entry count
• bounded TTL
• constant-time bearer comparison when authentication is configured
• optimistic version checks for write races
• non-root container execution
• dependency auditing in CI

Sky Cache does not provide tenant isolation, encryption at rest, distributed authentication, TLS termination, replication, consensus, cross-node invalidation, or durable audit logging.

Report suspected vulnerabilities through the repository's GitHub security/reporting channel without including live secrets in public issues.