This repository is an engineering preview and has no production-supported release yet. Security fixes are applied to the current main branch.

Please do not open a public issue for a suspected vulnerability, leaked credential, unsafe model artifact, or privacy defect. Use GitHub private vulnerability reporting instead.

Include the affected commit or version, reproduction steps, impact, and any suggested mitigation. Do not include real user images, credentials, signed URLs, or other sensitive data. If private reporting is unavailable, open a minimal issue asking the maintainers to enable a private contact channel without publishing exploit details.

Relevant reports include supply-chain or artifact-integrity failures, unintended image or diagnostic-data transmission, unsafe URL or cache handling, cross-origin deployment issues, and vulnerabilities in the packaged browser runtime. General model quality and unsupported-device problems belong in the public issue tracker unless they expose sensitive data or a security boundary.