Talyno is an iOS app that runs entirely on-device — there is no backend server, no user account system, and no remote database. Speech transcription (WhisperKit/CoreML) and translation (Apple's Translation framework) both run locally on the device. The only outbound network traffic is a user-triggered, one-time download of the optional talyno-whisper-small-finance speech model from HuggingFace (see docs/model-cards/).

Given this architecture, the most relevant categories of security issue are:

• Local data handling (SwiftData persistence, exported transcripts/audio, temp files)
• Anything that could cause the app to make unexpected network requests
• Supply-chain issues in the app's dependencies (WhisperKit, etc.) or in the published HuggingFace model artifacts
• Build/release tooling (scripts/release.sh) inadvertently exposing signing credentials

Please report security issues privately rather than opening a public GitHub issue.

• Email: poo9810@gmail.com
• Include: a description of the issue, steps to reproduce, and the potential impact.

We'll acknowledge reports as promptly as we can and follow up once the issue is understood or resolved. Please allow a reasonable window to address the issue before any public disclosure.

Only the latest release on the main branch is actively maintained. There are no other supported branches.