This local single-user app has no login. Keep its port bound to 127.0.0.1 and do not expose it through a proxy or public network. Set a credit cap on your own OpenRouter key.

If you find a vulnerability, use GitHub private vulnerability reporting for the repository once available; until then, contact the maintainer privately rather than publishing a proof of concept. Supported versions: the latest tagged release only.

Never include your API key, personal prompts or private data in an issue or test fixture. Remove a key through setup and revoke it on OpenRouter if compromised.