Security & responsible use
Updated 2026-09-08 · Review-stage notice
Local boundaries
The packaged desktop server binds only to loopback and requires a per-launch secret supplied by Electron. Renderer Node access is disabled, sandboxing is enabled, external navigation and permissions are blocked, and the production app uses a restrictive content policy. These safeguards reduce risk; they are not a guarantee against all attacks.
Safe media handling
Import only media you trust. Imports have an 8 GB limit and must fit available storage. The all-in-one release includes FFmpeg, a Python runtime, and faster-whisper; obtain updates only from the verified release page. Media decoders can have vulnerabilities; this release has not received an independent penetration test.
Report privately
Send a minimal description to jakenftwick@gmail.com. Do not include secrets, private media, or exploit anyone else’s data. No bug bounty or guaranteed response time is offered.
Release integrity
The initial Windows package is unsigned unless the download page explicitly states otherwise. Compare its published SHA-256 checksum. Do not turn off antivirus or device security to run it. Code signing and clean-machine testing are required before calling the release production-ready.