Security updates target the latest main branch.

Please report suspected vulnerabilities privately to the repository owner rather than opening a public issue containing exploit details, secrets, or private images.

Include the affected commit, reproduction steps using non-sensitive test data, expected impact, and any suggested mitigation.

The default server binds to 127.0.0.1. A public deployment must add TLS, shared rate limiting, monitoring, controlled model artifact delivery, and a production WSGI server/reverse proxy.

The application validates decoded image type, byte size, and total pixels, but no image-processing stack should be treated as a complete sandbox. Keep Pillow, Flask/Werkzeug, TensorFlow, PyTorch, Ultralytics, and base container packages updated through reviewed dependency changes.

Uploaded images are intended to remain in memory. Do not add persistence, analytics, model-feedback collection, or third-party uploads without explicit consent, retention limits, deletion controls, and updated documentation.