The default launcher is a local-only account service, not a public host. Read trust boundaries and controls and installation/recovery before using private data. Credentials, vault phrases and provider tokens must never enter Git, public issues, screenshots or example datasets. No administrator read/backdoor route exists, but active ML plaintext and service memory are accessible to the device's OS user/admin. Device compromise cannot be fixed by application encryption.

For a suspected vulnerability, contact Jason Stys privately with a minimal synthetic reproduction and affected version. Do not send private artwork, real credentials, recovery codes or tokens. Avoid public exploit details until a fix/disclosure plan is agreed. No response-time/SLA or independent security certification is promised. Check audits and release checksums; unsigned applications still need your own publisher/device trust decision.

The CodeQL guide defines genuine Python, JavaScript/TypeScript and GitHub Actions security-extended analysis, review steps and unsupported scope. The dated scan report distinguishes actual results from pending/missing evidence. Static scanning supplements the existing runtime, dependency, privacy and isolation checks; it does not certify every input or platform.