Security fixes are applied to the latest commit on main.

Please report vulnerabilities privately through GitHub Security Advisories for this repository. Include reproduction steps, affected files or workflows, and the expected impact. Do not include confidential deck content in the report.

HTML Slide Studio is a local developer tool. The Vite-only deck save endpoint can write existing deck.md files under the repository deck root and must not be exposed to an untrusted network. Production builds do not include that middleware.

The MCP server is also intended for local stdio use. It constrains file access to its configured deck root, but the process still inherits the permissions of the user who starts it.