Please open a private GitHub security advisory if the repository enables it, or contact the maintainer via the email listed in git history / GitHub profile. Do not file public issues for exploitable flaws until a fix is available.
The share server binds on all interfaces so phones on the same Wi‑Fi can connect. Access control is a random URL token, not authentication.
- Use only on networks you trust
- Stop the process (Ctrl-C) when finished
- Do not expose the port on the public internet
Models and Python packages (mlx-vlm, etc.) are third-party software. Review their licenses and security posture separately.