Security updates currently target 2.1.x.

FindFlow 2.1.1 is designed for trusted Windows local-area networks. Do not expose the Server port, client runtime, or database directly to the public internet.

• The client HTTP runtime binds to 127.0.0.1 and uses a per-process access token.
• FindFlow Server should be the only application account with write access to the .findflow directory.
• Client authentication is application-level access control for a trusted LAN; transport is not encrypted.
• Use host firewall rules, a private network profile, and an access-controlled database location.
• Do not port-forward 8788, publish it through a reverse proxy, or expose it to an untrusted network.
• Maintain independent backups of the server database and its managed assets.

Please use GitHub's private security advisory feature for suspected vulnerabilities. Include the affected version, reproduction steps, impact, and any suggested remediation. Avoid publishing exploitable details in a public issue before a fix is available.