HANCORE-linux's review identified unbounded endpoint responses, execution of repository-configured Git filesystem-monitor hooks during permission checks, and permissive access to speaker models and older recordings. duaneoca reported reproducing and fixing these paths, including repairing existing private-data permissions at daemon startup. HANCORE-linux separately confirmed the bounded-response fix from source and later confirmed the Git fix before raising the permission issue.
The memory measurements and runtime reproductions are duaneoca's reports. Marketplace verification applies to the exact published snapshot and does not constitute a security audit.
