Report private security issues to security@djconnect.dev.

• Do not log bearer tokens, Authorization headers, Spotify OAuth tokens, passwords, Home Assistant long-lived tokens or raw secret-bearing payloads.
• Store the DJConnect bearer token only in Windows Credential Manager or macOS Keychain.
• Keep local JSON settings non-secret.
• Run logs, diagnostics, feedback bodies, crash reports, clipboard exports and GitHub issue prefill text through DiagnosticRedactor before the user sees or shares them.
• Do not automatically upload screenshots, logs, crash reports or diagnostics.
• Treat 401/403 from authenticated DJConnect routes as stale pairing.
• Treat HTTP 426 protocol mismatch as an update-required condition, not as a token failure.
• Pairing must use the local Home Assistant URL. Remote Home Assistant URLs are non-secret metadata and may be used only after successful local pairing.

This repo contains a desktop client. Home Assistant owns Spotify OAuth, backend playback, Music DNA, Ask DJ history and Assist/TTS.