Please report security issues privately instead of opening a public issue.

• GitHub: https://github.com/joeseesun
• X: https://x.com/vista8

Include the affected endpoint, reproduction steps, expected impact, and any logs that do not contain secrets.

Do not commit .env, DeepSeek API keys, production .data snapshots, server environment files, or access tokens. The browser client never needs a model provider key.