Security fixes currently target the latest release on the default branch.

Do not open a public issue for a vulnerability that could expose local files, tokens, paths, user metadata, or destructive-operation bypasses. Use GitHub's private vulnerability reporting feature on this repository.

Include the affected version, reproduction steps, expected boundary, observed result, and whether any real files were moved, renamed, overwritten, recycled, or exposed. Use synthetic data whenever possible and never attach a real media library, workbench.local.json, runtime JSON, Adobe bridge token, or project file.

The HTTP server binds to 127.0.0.1 and is designed for a single Windows user. It is not an authenticated multi-user or internet-facing service. Do not expose port 8776 through port forwarding, a public reverse proxy, or a shared network.

The optional external Adobe bridge is a separate local component and is not distributed by this repository. Reports about that bridge should be sent to its maintainer unless the issue is in this repository's validation boundary.