Please do not open a public issue for a suspected security vulnerability. Contact the repository owner privately with a clear description, reproduction steps, and the affected version. Do not include API keys, book files, or other private data in the report.

BookWorm does not ship credentials or book content. Configure provider keys through environment variables or the local configuration file, which is kept outside the repository and written with owner-only permissions.