Please do not open a public issue for suspected vulnerabilities. Until a dedicated private reporting address is published, use GitHub's private security-advisory feature for the repository.

Supported security fixes target the latest released minor version. The project stores persistent user-provided content; operators are responsible for host, database, reverse-proxy, backup, and model-provider access controls.