Security

Keep the app on localhost. It is not a public multi-user service. Secrets belong in local environment/configuration, never browser bundles, chat or committed data.

If you discover a vulnerability, do not publish credentials, private rosters, provider sessions or a working exploit against another user's installation. A private maintainer reporting channel must be established before public launch. No reporting address or response SLA is claimed for this source preview.

Gameplay and agent execution are optional experimental surfaces with separate grants and approvals. Do not weaken those boundaries to make an unsupported provider appear connected.