Agent File Bridge creates bearer-token upload and download URLs. Treat every generated URL as a secret.

• Run behind HTTPS.
• Put the service behind a reverse proxy, VPN, or authentication layer when handling sensitive data.
• Restrict AFB_ALLOWED_ROOTS to directories intended for sharing.
• Use short TTLs and low download limits.
• Store uploads in a quarantined directory.
• Do not execute uploaded files.
• Consider antivirus scanning for untrusted uploads. Set AFB_CLAMAV_SOCKET to enable ClamAV scanning.

Please open a private security advisory on GitHub or contact the maintainer through GitHub.