Only the current release branch receives security updates.

If you discover a security vulnerability, please do not open a public GitHub issue.

Report it privately:

• GitHub: use Security Advisories
• Email: contact the maintainer via the GitHub profile

• Description of the vulnerability
• Steps to reproduce
• Affected version
• Potential impact

• Acknowledgement within 3 business days
• Fix or mitigation within 14 days for critical issues
• Public disclosure after the fix is released

This project runs locally and is not designed for public internet exposure by default.

Key points:

• Установка API_KEY в .env для ограничения доступа к REST API
• Do not expose port 9696 to the internet without a reverse proxy and authentication
• Keep .env out of version control — it is listed in .gitignore
• Tokens (HF_TOKEN, TELEGRAM_*, FTP_*) are secrets — never commit them