Facet Forge is an experimental, trusted-local application, not a public web service or a sandbox for hostile users. Do not expose its loopback port over the network. Do not execute commands embedded in third-party asset descriptions.

• .runtime/session.json holds an authentication token. .runtime/autosave.json holds private work and history. Never upload either.
• output/ may contain private models and images. Only share deliberately selected artifacts.
• The app does not contact a model provider. Your MCP client sends tool results, including renders, to whichever assistant you configure.
• Recipe validation rejects many malformed requests, but bounds, geometry limits and local authentication are not a complete security audit.
• The Windows download includes the Godot executable and is unsigned. Verify SHA256SUMS.txt, inspect the source, and apply your normal software trust policy.

For a sensitive issue, use GitHub's private Report a vulnerability feature if enabled. Do not post credentials, personal paths, or private recipes in public issues. If private reporting is unavailable, open a minimal issue asking for a private contact channel without disclosing the vulnerability.