Security updates currently target the latest 1.x release.

FindFlow V1.0 is designed for trusted Windows local-area networks. Do not expose the client runtime or shared workspace directly to the public internet.

• The client HTTP runtime binds to 127.0.0.1 and uses a per-process access token.
• Workspace authorization also depends on operating-system and network-share permissions.
• Any user with direct read access to the .findflow directory can inspect workspace files.
• Use an access-controlled NAS or file server and maintain independent backups.
• Do not store the data directory in a publicly synchronized or anonymously writable share.

Please use GitHub's private security advisory feature for suspected vulnerabilities. Include the affected version, reproduction steps, impact, and any suggested remediation. Avoid publishing exploitable details in a public issue before a fix is available.