Please report suspected vulnerabilities privately to the maintainers before public disclosure.
- Browser-side processing is preferred for local file work.
- Worker jobs must run in ephemeral directories with bounded retention.
- File contents, secrets, and signed URLs must not be written to logs.