Worth understanding before you configure it, because the answer is not "nothing":

• It holds a live spending credential. VISION_API_KEY is a real key with no test mode, so a tool call that succeeds costs money from the account it belongs to.
• It reads local files. Only inside the directories passed as arguments — the working directory when none are given — and paths are resolved with realpath on both sides before being compared, so a symlink inside an allowed directory cannot point out of it. Files over 20 MB are refused locally.
• --allow-any-path removes that boundary entirely. With it on, the server can read any file your user account can, and output: "text" on a private document is a working way to put that document's contents into a model's context and into your host's transcript. It warns on stderr at startup. Prefer naming directories.
• It writes nothing. No tool creates, modifies or deletes a file, or mutates anything in the account — the seven tools are extraction and reads.

If you are reporting something in this area, a working example against a directory you control is far more useful than a description.

Please do not report security issues through public GitHub issues, pull requests, or discussions. A public report is a disclosure, and it puts every user of this library at risk before there is a fix to move to.

Report privately through either:

• GitHub — the Report a vulnerability button under this repository's Security tab, which opens a private advisory only the maintainers can see; or
• https://support.visionapi.io, or https://visionapi.io/contact-us if you do not have an account.

Please include what you need to make the problem reproducible: the version, the platform, and the smallest example that shows it. If you have a suggested fix, all the better — but a clear report on its own is worth more than a vague one with a patch.

We will acknowledge your report, keep you updated as we work on it, and credit you in the advisory unless you would rather we did not.

Fixes land on the latest released version. There are no long-term support branches; if you are behind, the upgrade path is forward.

In scope: anything in this repository that lets an attacker read or alter data they should not, forge a webhook signature, leak an API key, or execute code through untrusted input.

Out of scope here, but still worth telling us about at https://support.visionapi.io: problems in the Vision API service rather than this client, and anything about an account, billing, or the website.

A Vision API key is a spending credential. There is no publishable key and no test mode, so a key that reaches a browser bundle is readable by anyone who loads the page. The React and Vue packages exist precisely so a frontend never has to hold one: they call your endpoint, which holds the key server-side. If you find a code path in any of these libraries that could put a key in front of an end user, that is a vulnerability and we want to hear about it.