SECURITY.md

Security Policy

Reporting

Email security@ardalink.local or open a private advisory.

Threat model (summary)

• Browser-side API tokens (Realtime ephemeral keys) must be short-lived
• WebRTC/browser microphone capture requires explicit user consent
• No PII in client-side logs