Security model
The application blocks cross-origin writes, uses CSRF tokens, applies strict CSP/HSTS, bounds uploads, validates model URLs, blocks SSRF/private targets, and keeps llama.cpp loopback-only by default.
Docs / Security model
The application blocks cross-origin writes, uses CSRF tokens, applies strict CSP/HSTS, bounds uploads, validates model URLs, blocks SSRF/private targets, and keeps llama.cpp loopback-only by default.