RTSP URLs commonly contain camera usernames, passwords, tokens, or private network addresses. Keep your working config.json private; it is ignored by Git. Do not paste real camera URLs into issues, logs, screenshots, or pull requests.

Use config.example.json when reporting configuration problems. If a secret is committed, rotate it immediately—removing it from the latest commit does not remove it from Git history.

The external VLC fallback must pass a stream URL as a process argument. On a multi-user machine, another local user may be able to see that argument. Prefer the native VLC, FFmpeg, or go2rtc backend when URLs contain credentials. The go2rtc desktop process sends its URL to the bridge over stdin rather than placing it in the process argument list.

Please report security-sensitive problems privately to the repository owner rather than opening a public issue.