If you discover a security vulnerability, please report it by emailing security@paiml.com.

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes

We will acknowledge receipt within 48 hours and provide a detailed response within 7 days.

whisper.apr runs in the browser's WASM sandbox, providing memory isolation from the host system.

Audio data is processed locally in the browser. No audio is transmitted to external servers unless explicitly configured.

Models are loaded from configured URLs. Ensure models are served over HTTPS in production.