Security fixes are provided for the latest Zodyark 1.x release.

Do not open a public issue containing a credential, router response, network identifier, or exploit. Use GitHub's private security advisory flow for this repository. Include the affected version, platform, reproduction steps, impact, and a minimally sanitized proof of concept.

The project aims to acknowledge a complete report within three business days. Please allow time for coordinated remediation before public disclosure.

• Zodyark does not require elevated privileges for normal monitoring.
• Provider credentials are referenced from the OS credential store and are never placed in SQLite.
• Router endpoints must resolve to loopback, link-local, or private network addresses.
• External AI endpoints require HTTPS; plaintext HTTP is accepted only for loopback providers.
• Export paths must be absolute, point to an existing directory, and match the selected extension.

See docs/privacy.md for the data-flow model.