Security

Run the UI on loopback behind SSH; there is no authentication. Only load trusted checkpoints: the research code uses torch.load with weights_only=False for legacy frontend checkpoints. Do not submit secrets or private data in public issues. This source candidate has no published vulnerability-reporting address yet; maintainers must configure one before public release.