K3 Flight is an experimental local inference server distributed as a prebuilt executable. It is not a hardened multi-tenant service.

• Bind the server to 127.0.0.1 unless network access is intentionally configured and protected.
• Download binaries and model files only from release locations linked by this repository.
• Verify SHA256 manifests before first use and after every upgrade.
• Run the executable as an unprivileged user with access limited to the model directory it needs.
• Do not place private prompts, logs, credentials, or model paths in public issues.
• Treat model files, prompts, API requests, and imported chat history as untrusted input.

Security reports may include binary integrity failures, unsafe file handling, unauthorized network access, API authentication bypass where authentication is documented, memory-safety issues, and unintended disclosure of prompts or local files.

Performance limitations, unsupported hardware, model output quality, prompt injection inherent to model behavior, and requests for Runtime source access are not security vulnerabilities by themselves.

Do not disclose an unpatched vulnerability in a public issue. When a binary Release is available, use this repository's Security → Report a vulnerability flow and include a minimal reproduction, affected version, environment, impact, and suggested mitigation.

No executable is currently distributed from this repository. A private reporting channel will be enabled before the first binary Release.