Please report security concerns privately through GitHub's security advisory feature rather than opening a public issue.

The application is a static client-side experience. It does not request camera, microphone or location access, and it does not collect or submit personal information. Portrait frames are read from a public Amazon S3 asset host.

The latest deployment from the default branch is the supported version.