Security policy The application binds to 127.0.0.1 by default. Local LLM URLs are restricted to loopback addresses. Do not expose the service to a LAN or the public Internet without authentication, TLS, upload scanning, rate limits, and a reverse proxy. Treat uploaded media and generated transcripts as sensitive local files. Report vulnerabilities through a private GitHub security advisory when the repository is published. Online ASR secrets Never commit OPENAI_API_KEY, APP_ACCESS_TOKEN, .dev.vars, or .env files. Do not place third-party API keys in GitHub Pages JavaScript or browser local storage. Restrict ALLOWED_ORIGINS to the actual GitHub Pages origin and rotate the access token periodically. Set provider-side usage and spending limits before enabling a public endpoint.