This project is in active development. Security fixes are applied to the latest commit on the default branch.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, email vinceshine6789@gmail.com with:

• A description of the issue
• Steps to reproduce
• Potential impact
• Any suggested fix (optional)

You should receive a response within a few business days. We will work with you to understand and address the issue before any public disclosure.

• Secrets: Never commit .env files, API keys, or credentials. The repo gitignores these paths; report if you find exposed secrets in history.
• Dependencies: Python and Node dependencies are pinned loosely (>= in requirements, semver ranges in package.json). Run pip audit / npm audit in your environment for known CVEs.

• Webcam access is opt-in via --track or the tracking toggle in user-tracker/
• Downloaded models (MediaPipe) are stored locally and gitignored
• The web component runs pointer tracking only — no camera access