Please report security issues privately to the project maintainer before opening a public issue.

Murmur AI starts a local HTTP service bound to 127.0.0.1 by default. Do not expose this service to a public network unless you understand the risk and have added your own network controls.

API keys belong in the app data .env file or environment variables. Do not commit secrets, private endpoints, or personal model paths.

Security fixes target the latest GitHub release and the main branch.