Security fixes are provided for the latest released version.

Please report vulnerabilities privately through GitHub's security advisory feature. Do not open a public issue for credentials, authentication bypasses, or other exploitable findings.

• Keep Slack tokens, channel IDs, and SSH keys outside the repository.
• Restrict /etc/lightwatch.env to root with mode 600.
• Use a dedicated NAS account with the minimum required permissions.
• Do not expose the FastAPI service directly to the public internet.
• Add authentication and TLS through a trusted reverse proxy or access-control service when remote access is required.
• Review image contents before using LightWatch in spaces where people or confidential information may be visible.