Open a private security advisory through GitHub's "Report a vulnerability" button on the Security tab. Please don't file a public issue for anything exploitable.

• SSH private keys. Read from disk to authenticate; never transmitted, never logged. create_ssh_key writes id_ed25519_sift with mode 0600 and refuses to overwrite an existing key.
• Remote shell commands. Album and artist names come from file tags, which come from files you didn't write. Everything user-controlled is passed through shell_quote, which is tested by running its output through a real shell and asserting the string comes back unchanged. If you add a command, quote it.
• Setup codes. Base64, not encryption. Without a Tailscale key they contain no secret. With one they are a credential — use single-use keys.

• Host key verification is trust-on-first-use and does not persist. Handler.pinned is always None, so a changed host key is not detected.
• Passphrase-protected SSH keys are unsupported and fail as a generic authentication error.
• The asset protocol scope is **, so the webview can read any path. This enables audio preview of arbitrary files you point Sift at; it should be narrowed to the scanned directory.
• Release binaries are unsigned. Verify checksums if that matters to you.