Security fixes are best-effort for the latest code on the default branch.

Please do not open public issues for security-sensitive problems.

Instead:

1. Use GitHub private reporting or a private maintainer contact channel if available.
2. Include clear reproduction steps, impact, and any suggested mitigation.
3. Allow time for the issue to be reviewed before public disclosure.

This repository includes a local browser-driven AI integration. Please report:

• exposed secrets
• unsafe defaults
• privilege or access control issues
• command execution or path traversal issues
• insecure network exposure

Third-party services and external account policies are outside the scope of this repository, but security issues in how this code interacts with them are in scope.