Report vulnerabilities privately through GitHub's security advisory feature. Do not include tokens, private media, model artifacts, or personal data in a public issue.

The gateway must be deployed behind a firewall or authenticated reverse proxy. Set a strong GATEWAY_TOKEN, keep PUBLIC_RESULTS=false, and do not expose the raw TTS, ASR, or face-to-face ports beyond localhost.