SpeakLab is a personal, local-first project (see docs/PRIVACY_AND_SECURITY.md for the current privacy/security model). It is not a production service handling other people's data, but reports about real issues are still welcome.

Please use GitHub's private security advisory feature for this repository rather than opening a public issue, so any real vulnerability isn't disclosed before a fix is available. Include:

• What you found and why it's a security or privacy concern.
• Steps to reproduce, if applicable.
• The affected version/commit.

There is no bug bounty and no guaranteed response time — this is a single-maintainer personal project — but reports will be read and taken seriously.

Relevant: anything that could leak local data off the machine, bypass the upload validation described in docs/PRIVACY_AND_SECURITY.md, enable path traversal or arbitrary file access, or otherwise break the local-first privacy model this project is built around.

Not relevant (already known/documented, not a new finding): the mock analysis providers not performing real speech analysis (see docs/SCORING_AND_LIMITATIONS.md), the audio-retention setting not yet being enforced, or the standalone production server's API routing gap — all covered in docs/PROJECT_STATUS.md.