Do not open a public issue for vulnerabilities, leaked credentials, authentication bypasses, signing concerns, or unintended network exposure.

Use GitHub's private vulnerability reporting for this repository when available, or contact challychoi@gmail.com with the subject Tellama security report. Include the affected version, device and Android version, reproduction steps, and impact. Remove API keys, personal prompts, model files, and unrelated logs.

We will acknowledge a valid report, investigate privately, and coordinate disclosure after a fix is available. We do not promise a bounty program.

Security fixes target the latest Tellama release. Users should update through Tellama's in-app Update Center or the latest GitHub release.

• Use Wi-Fi LAN mode only on a trusted private network.
• Keep Bearer keys private and revoke keys that may have been copied or logged.
• Do not expose port 11434 to the public internet.
• Stop the server when it is not needed.