Sentinel is designed for local-only operation by default.

• API binds to 127.0.0.1 unless explicitly changed.
• No cloud calls are required for core functionality.
• Telemetry is OFF by default.
• Camera credentials are sanitized in logs/API and stored via the OS keychain where available, with encrypted local fallback.
• Encrypted fallback secret files are created or replaced with owner-only permission attempts where the platform supports them.

• Python 3.12 is the supported backend runtime. The package is pinned to >=3.12,<3.13.
• Node.js 20 and npm 10 are the supported frontend build/runtime tooling.
• Newer runtimes should be validated in a dedicated upgrade branch before being treated as supported.

Binding to 0.0.0.0 enables LAN access and increases risk.

If you opt in to LAN mode:

• Place Sentinel behind a trusted LAN/VPN.
• Use host firewall rules.
• Avoid exposing Sentinel directly to the public internet.
• Rotate camera credentials and use least privilege accounts.
• Data/export directory changes, native folder picking, and runtime shutdown are restricted to loopback clients even when the UI is LAN-visible. Browser-originated directory changes must use server-issued local picker selection tokens instead of raw path strings.

The UI displays a warning banner when LAN exposure is active.

• RTSP passwords are redacted before log and UI output.
• Local fallback secret files, runtime databases, logs, media, exports, model weights, environment files, and operator notes must not be committed.
• Export files may include operational metadata and should be handled as sensitive.
• Event media can contain personal data; enforce retention and access controls.

Use GitHub private vulnerability reporting or a private security advisory when available. If a private channel is not available, open a minimal public issue that asks for security coordination without exploit details, credentials, logs, media, or sensitive file paths.