Echo is at v1.0.0. Security fixes target the latest released minor version.

Please report suspected vulnerabilities privately via GitHub Security Advisories (the "Report a vulnerability" button on the repository's Security tab) rather than opening a public issue. Include a description, reproduction steps, and the affected version. We aim to acknowledge within a few days.

• Echo's deterministic core makes no network calls at runtime and reads only local files you point it at. The hear (Demucs/torch) and see (OpenCV) extras are opt-in and pull heavy third-party dependencies with their own security surfaces.
• Echo parses scene-graph JSON and audio/video files. Treat untrusted media and scene graphs as you would any untrusted input; ffmpeg is invoked for media ingest in the hear/see paths.