Lines is a local, single-user application. It binds only to loopback addresses and rejects requests with non-loopback host names. It has no remote-access or multi-user security boundary.

Lines can edit and move files inside configured scan roots. Run it only on a trusted computer and keep backups of important skills. Do not expose its port through a proxy, tunnel, or port-forward.

Lines is currently pre-release. Security fixes apply to the latest commit on the default branch until the first versioned release.

Do not open a public issue for a vulnerability. Use GitHub's private security advisory feature for the repository. Include the affected endpoint or file operation, reproduction steps, and the expected security boundary.