Security fixes target the latest tagged release and main.

Use the repository's Private vulnerability reporting feature. Do not open a public issue for a vulnerability that could expose recordings, transcripts, credentials, or allow unintended file deletion.

Include reproduction steps using synthetic data. Never attach a private audio file, diary export, Hugging Face token, or API key.

EchoField processes microphone recordings and derived text. Treat all of these as sensitive:

• recorder WAV files
• local archive and processing directories
• raw, diarized, and cleaned transcripts
• Markdown diary output
• Hugging Face and cloud-provider credentials

Recorder deletion is opt-in and guarded by artifact validation plus a source-to-archive SHA-256 comparison. A failed check must retain the source file.

EchoField does not provide encrypted storage. Use FileVault and an encrypted backup for data at rest.