Security fixes target the latest release on the default branch.

Please use GitHub's private vulnerability reporting feature once the repository is published. Do not open a public issue for an unpatched vulnerability and do not include real API keys or private scores in a report.

The Note2MIDI bridge binds to 127.0.0.1 by default. Keep it on loopback unless you understand the consequences. It accepts score uploads, can run Audiveris, and can hold a Gemini key in process memory. Only add origins you control to NOTE2MIDI_ALLOWED_ORIGINS.

Uploaded files are checked by extension, magic signature, and size; processed in a newly created private temporary directory; passed to Audiveris without shell interpolation; and removed after each request.

• Do not put secrets in frontend code or variables prefixed with NEXT_PUBLIC_.
• .env and .env.* files are ignored; .env.example contains blank placeholders only.
• A key entered through Settings remains in bridge process memory and is never returned by the settings or health endpoints.
• Error sanitization redacts common key/token/secret assignment patterns from captured OMR process output.