Do not open a public issue for a suspected vulnerability. Use the repository's private vulnerability reporting channel or contact the maintainer privately. Include affected versions, reproduction steps, impact, and any known mitigation.

Only the latest development/release line receives security fixes unless a maintainer explicitly announces otherwise.

• The Electron renderer is sandboxed and isolated from Node. Privileged actions cross the preload/main IPC boundary.
• Electron validates RPC method names and some request shapes before forwarding to the Rust sidecar. Coverage is incomplete; renderer TypeScript types are not a security boundary.
• pumas-rpc binds to loopback by default and limits body size and concurrent requests.
• pumas-rpc --allow-lan currently has no caller authentication or authorization. Do not expose it to an untrusted network.
• The Torch sidecar is loopback-only by default. Non-loopback use requires both PUMAS_TORCH_ALLOW_LAN=1 and PUMAS_TORCH_API_TOKEN; all routes except /health then require the token.
• Model paths, import roots, URLs, archives, and generated runtime commands are privileged inputs and must be validated at their receiving boundary.

Hugging Face tokens and other secrets must never appear in logs, errors, URLs, or diagnostics. The 2026-09-03 audit found that backend debug logging can record complete set_hf_token parameters and Electron can persist that output. Until the handler is fixed, do not set credentials while running the backend with --debug or the desktop app in development/debug mode. Rotate any token that may have been exposed and inspect/remove affected local logs.

Public error responses must use stable redacted error types rather than raw internal path, URL, or dependency messages.

Authoritative dependency inputs are the checked-in Cargo and pnpm lockfiles plus the Python requirements under torch-server/. The Torch production requirements are not currently resolved into a reproducible lock.

Before a release, run current vulnerability and license checks against the resolved shipped dependency closure for all three ecosystems. Record tool versions and results with the release evidence. Do not rely on removed SBOM or scan snapshots; they described obsolete dependencies and were not generated by the current release workflow.

Useful local tools include cargo audit, npm audit, and pip-audit, but a tool result is meaningful only when its inputs match the final artifact.

Security and boundary findings are prioritized in the current standards audit. Credential-safe diagnostics and the RPC/LAN threat model are the first required remediation slice.