Please report vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue.

This is a static site with no backend or accounts. Audio stays in the browser. The only outside requests are the model download from Hugging Face, which happens after you confirm it.