Do not commit real credentials, face libraries, household snapshots, recordings, provider IDs or exported HA traces. Example URLs use placeholders; configure real values only in your deployment. Rotate any credential previously made public.

The AI API uses a shared Bearer secret on the internal HA network. Port 8099 is not mapped to the LAN by default. Do not expose the app or Frigate's unauthenticated API directly to the internet.

Images are processed locally by OpenVINO or Ollama. Initial image builds and model downloads require internet access. Verification descriptions are stored in app data/logs and may describe private scenes. Frigate and Companion notifications have their own data handling.

For security reports, use GitHub private vulnerability reporting when enabled. Otherwise contact the maintainer privately before posting sensitive details. Do not include credentials in public issues.