AI Canvas is in early development and does not yet publish stable signed binaries.

Please do not open a public issue for a vulnerability or suspected credential exposure. Use a private GitHub security advisory and include a minimal reproduction, affected revision, impact, and suggested mitigation if known.

Do not attach real API keys, private project archives, or personal media. Use revoked test credentials and sanitized fixtures.

• API keys must never be committed, pasted into issues, or included in screenshots.
• The secret scanner and pre-commit hook reduce accidental commits but cannot guarantee that a key is safe.
• If a key reaches Git history or a public log, revoke/rotate it immediately before attempting history cleanup.
• The current development app stores provider credentials in WebView localStorage; use limited, revocable keys until OS credential storage is implemented.
• Custom provider base URLs receive the configured credential. Only use domains you trust.

The Rust storage API and model proxy are designed for localhost development. Do not bind or deploy them as public multi-user services. A hosted deployment would need authentication, authorization, tenant isolation, rate limiting, abuse controls, secret management, and a separate threat review.

Before official end-user binaries are described as stable, the project should add:

• macOS Keychain and Windows Credential Manager integration;
• a reviewed Tauri Content Security Policy;
• signed/notarized release artifacts;
• Windows CI and platform verification;
• dependency and release-artifact vulnerability scanning.