narrate is meant to run on a trusted network. Treat OPENROUTER_API_KEY and JELLYFIN_API_KEY as secrets. Set NARRATE_BASIC_AUTH if the import UI is reachable beyond localhost.

Do not file issues that include API keys, book files, or generated audio.

To report a vulnerability, use GitHub's private reporting on this repository.