Blask is a local, single-user editing tool. It intentionally has:

• No built-in authentication or authorization. Every action (save, create, delete, rename, image upload, git commit + git push) is reachable by anyone who can reach the HTTP port. There are no accounts, no login, no per-user permissions.
• Full filesystem write access to the Astro project it manages (the directory pointed to by BLASK_PROJECT / blask.config.ts).
• Git push capability into that project's remote, using whatever credentials the host/container provides.

1. Keep it on localhost. For local editing, run npm run dev and access it only at http://localhost:3001. Do not bind it to a public interface.
2. Never expose the port directly to the internet. If you self-host the studio (e.g. in Docker), put it behind an authenticating reverse proxy — Traefik/Nginx BasicAuth, an SSO proxy, a VPN, or an IP allowlist. The bundled docker-compose.example.yml shows Traefik BasicAuth; do not remove that middleware.
3. Scope the deploy key. The git push credential mounted into the container should be a deploy key limited to the single content repo, not an account-wide key.
4. Trust your content repo. Blask parses every markdown file's frontmatter. Only point it at repositories whose contributors you trust; treat unreviewed pull-request content as untrusted input.

Please do not open a public GitHub issue for security problems.

Report privately via GitHub Security Advisories ("Report a vulnerability" on the repository's Security tab), or by email to the maintainer listed in package.json.

Include: affected version/commit, a description, reproduction steps, and the impact you observed. We aim to acknowledge within a few days.

Blask is pre-1.0. Only the latest main (and the most recent tagged release) receives security fixes. Pin a commit if you need stability.