This project is intended for user-initiated file transfers on a trusted local network. It does not provide authentication or TLS. Anyone able to reach the server can access and modify the exposed directory.

• Use a dedicated sharing folder, not a directory containing secrets or unrelated documents.
• Run one server at a time and stop it when the transfer screen closes.
• Do not forward the port to the Internet or enable it silently in the background.
• Do not allow another process to change symlinks or directory structure during transfers.
• Hiding a browser control does not disable the corresponding HTTP operation.

Use GitHub's private Report a vulnerability option in this repository's Security tab when available. If private reporting is unavailable, open an issue requesting a private contact channel without including exploit details, personal files, or credentials.

Please include the affected commit or version, platform, impact, and a minimal reproduction using synthetic data. There is no guaranteed response time or paid support commitment.