The public deployment is a static browser runtime under web/. It should not ship server-side inference endpoints, private memory packs, raw source materials, or credentials.

If you find a security or privacy issue, open a private report through GitHub security advisories if available, or contact the repository owner directly. Do not publish private paths, credentials, raw local artifacts, personal documents, or reproduction steps that expose sensitive data.

Before deployment, run:

npm run check:release

The release check blocks tracked private artifacts, obvious local paths, vendored WebLLM experiments, local model weights, and generated private memory payloads.

Do not commit Vercel tokens, .env files, cloud credentials, API keys, private model URLs, or local machine paths. The public runtime does not require secrets.