Security fixes are applied to the latest release.

Do not open a public issue for a vulnerability that could expose user files or systems. Use GitHub private vulnerability reporting if enabled, or contact the repository owner privately. Include affected version, reproduction steps, impact, and a minimal proof of concept. Avoid uploading private photographs or active credentials.

The project processes images in memory when run locally. A remotely hosted instance receives uploaded image bytes, so operators must secure transport, access, logs, and hosting.