Security fixes are provided for the latest public Soundquest release.

Please use GitHub's private security-advisory reporting flow for this repository. Do not include microphone recordings, private links, access tokens, or other personal data in a public issue.

Include the affected revision, browser, reproduction steps, impact, and any suggested mitigation. The project will acknowledge a report as soon as practical and coordinate disclosure after a fix is available.

• Shared-run data must remain bounded, versioned, and non-executable.
• Recorded audio and saved runs must remain local unless the user explicitly exports them.
• The vendored Strudel evaluator accepts the local player's creative code and therefore requires unsafe-eval; remote shared code must never reach it.
• deploy/strudel/packages/sampler/sample-server.mjs is developer tooling and must not be exposed as a public service.