Seiton binds to 127.0.0.1 and is not intended to be exposed to a network. It has no telemetry, no accounts, and no server component that I run. Data lives in a local SQLite file. AI features, when enabled, invoke a command-line tool that you configure — Seiton does not talk to any model provider on its own.

The API is protected by a token generated at startup and injected into the page, and it rejects requests whose Host or Origin headers don't match the local server. This is enough for a local single-user tool. It is not enough to put Seiton on the open internet, and you should not do that.

The latest release only. This is a one-person project; there are no maintenance branches.

Please do not open a public issue for security problems.

Email d.studylab@gmail.com with:

• what the issue is, and what an attacker could do with it
• steps to reproduce
• the version you're on, and your OS

I'll confirm I received it as soon as I can, and I'll tell you honestly whether and when I can fix it. If you want credit in the release notes, say so and I'll include you.

• Installer builds are unsigned. Windows SmartScreen will warn about them. Only download from the official GitHub Releases page.
• The startup token lives in the page. Anything that can already read your browser's memory or your filesystem can get it. Seiton's threat model assumes your own machine is not already compromised.
• Allowed roots are trusted. Registering a folder means Seiton may read what's in it. Register only what you mean to.