Security

Stewarrd can control download clients, request media imports, and permanently remove payloads when authorized by enabled policies. Run it on a trusted network or behind HTTPS with restricted access. Treat its access token and data backups as credentials. Keep download and evidence mounts read-only.

Reporting a vulnerability

Email james@ltl.so privately with the affected version, reproduction steps, impact, and any proposed fix, or open a private security advisory on GitHub. Do not post exploits, tokens, client credentials, or personal logs in public issues.

Security fixes go into the next release; older releases are not patched separately. Check the release notes before upgrading.