FrameWatch 0.1 is intended for local desktop use. Run the standard CLI on loopback. It has no multi-user authentication and must not be exposed directly to a LAN or the Internet.

Captured samples can include process names. They remain in the local SQLite database unless you export or share them. The application does not send telemetry to a remote service. Public example data and screenshots are synthetic.

CSV files are treated as data: numbers and embedded process arrays are validated, and no spreadsheet formulas or uploaded scripts are executed. File sizes and row counts are bounded. Host/Origin checks constrain browser access.

If reporting a potential vulnerability, provide a minimal sanitized reproduction and avoid posting credentials or real captures in public issue attachments.