stoa is a proof of concept, not a hardened system. Run it on infrastructure you control, with data you're comfortable putting through it.

There's no formal disclosure process while it's a proof of concept; that comes with the production release. If you hit a security issue in the meantime, report it privately through this repo's GitHub security advisories (the Security tab, "Report a vulnerability") rather than opening a public issue.

The repo ships no credentials. R2 keys, W&B and Hugging Face tokens, and .r2env files are read from the environment at runtime and gitignored. If you find one committed anywhere in the history, report it the same way.