Bitsend is designed for trusted LANs and Tailscale networks. It is not intended to be exposed directly to the public Internet.

Please do not open a public issue for a credential, authentication, path traversal, or remote-code-execution vulnerability. Contact the repository owner privately through the GitHub security advisory workflow after replacing YOUR_GITHUB_USERNAME in the project links.

Include:

• affected version or commit;
• operating system;
• reproduction steps or a minimal proof of concept;
• impact assessment;
• any suggested mitigation.

• Keep the host JSON private; it contains the static host token and device API keys.
• Use Tailscale or an HTTPS reverse proxy when credentials must cross an untrusted network.
• Never commit real host tokens or API keys.
• Rotate a device key immediately if it may have been copied.