Vindhem Server is development software intended for a single owner on a trusted local machine. The packaged launcher binds to loopback and requires its generated bearer credential. It is not a public hosting gateway or a sandbox for agents. Do not expose its port through a tunnel, router or reverse proxy as a substitute for a separately reviewed remote-access design.

Keep the installation directory private. It contains the credential, database, media, staged work and agent call receipts. Receipts can contain personal metadata and file paths. Do not include that directory in an issue or commit. Read access to the owner's account may include access to these files; local authentication does not defend against a compromised owner account.

MCP upload roots restrict file access through that adapter only. They do not restrict an agent's terminal or other tools. Approve only the folders intended for import. Metadata, filenames, companion bodies and tool results are untrusted data, not instructions for an agent to execute.

Imported originals are left unchanged, but authorized library operations can modify or delete managed data. Portable Library export omits companion objects, staging and server configuration; it is not a full backup. Preserve the full data directory with the server stopped when making a filesystem backup.

Use GitHub's private vulnerability reporting option if it is available on the repository's Security tab. Do not post credentials, private library data or unpatched exploit details in a public issue. If private reporting is unavailable, open an issue asking for a private contact without including those details.

Include the server revision, Node.js version, operating system and a minimal reproduction using synthetic data. Only the current development revision is maintained; there is no security-update promise for historical builds.