For a vulnerability, contact the maintainer through the private vulnerability-reporting option on the repository Security tab when available. If that option is unavailable, open an Issue asking for a private contact channel without exploit details or private images. Do not use a public Issue for credentials or personal photographs.

Decode malformed files only in a test environment. The app depends on native RAW / image decoders and an ONNX runtime, so upstream security updates matter. Dependency downloads are checksum-pinned; updating a dependency requires reviewing its origin, hash and notices.

No formal security audit, sandbox guarantee or support SLA is claimed for this development build.