Lighttable runs entirely on your own machine — there is no hosted service,
no telemetry, and no data leaves localhost. The backend binds to 127.0.0.1
by default. As such, the realistic attack surface is local: untrusted input
files, path traversal, or command-injection via the optional external tools
(exiftool / RawTherapee / darktable / ffmpeg) and the optional local LLM
endpoint.
Lighttable 完全在本机运行，没有托管服务、不收集遥测、数据不出 localhost，
后端默认只绑 127.0.0.1。实际安全面是本地的：不可信的输入文件、路径穿越，
或经由可选外部工具 / 本地 LLM 端点的命令注入。
Please report security issues privately, not in a public issue:
- Open a private GitHub Security Advisory on this repository (Security → Report a vulnerability), or
- Contact the maintainer through their GitHub profile.
请通过私密渠道报告：在本仓库 Security → Report a vulnerability 提交私密公告， 或经维护者 GitHub 主页联系。不要在公开 issue 中披露未修复的漏洞。
We aim to acknowledge reports within a reasonable time and will credit reporters who wish to be credited once a fix is available.