The latest version on the main branch receives security updates during the draft phase.

Do not open a public issue for vulnerabilities that expose credentials, private data, or unsafe file handling. Contact the maintainers through the official channel on CrushOn.AI and include a concise reproduction without real user data.

The toolkit reads and writes local JSON files. It does not require network access. Never place API keys, authentication tokens, private conversations, user identifiers, or internal service URLs in a public world card.