Please report vulnerabilities privately through GitHub's security advisory interface for this repository. Do not include active API keys, private prompts, or production responses in a public issue.

Claude Arena keeps ANTHROPIC_API_KEY in the server process and never persists it. Local history does contain prompts and model responses unless --no-store is used. The built-in HTTP server is intended for localhost use; it does not provide authentication or TLS for public deployment.