Security Do not commit API keys, cookies, or session tokens. XAI_API_KEY and provider secrets stay in the environment, never in git. The compositor is user-initiated. Do not call the model on keystroke, on page load, or in a loop. Dumps are capped at 8,000 characters. History never leaves the browser. Report vulnerabilities privately: open a security advisory on this repo, or email the owner via GitHub. This project is operated by anwhelan01.