Editing, tracking, background reconstruction and export happen in the browser. Opened videos are read through URL.createObjectURL. Export decodes, renders, encodes and muxes in the browser (WebCodecs) and hands the file to the user as a download. Fonts are self-hosted.

AI edits are the one exception, and only when the user runs one. The Studio then sends the selected range of the original clip (at most 10 s, padded to 16:9 or 9:16) to the local AI server (apps/ai-server, bound to 127.0.0.1). For a third-party provider (Google Gemini Omni Flash), the server uploads it to Google. The edit plan says this before anything is sent. The free mock provider keeps everything on the machine.

• The provider key (GEMINI_API_KEY) is read from the git-ignored .env.local or the process environment. It is sent only in the x-goog-api-key header, redacted from every error message, and never returned to the browser or written to logs or to the cost ledger.
• Paid operations are refused unless the owner sets PRECISIONEDIT_PAID_OPS=on together with a budget (PRECISIONEDIT_PAID_BUDGET_USD). Each paid job also needs a per-request approval that covers its estimated cost. A paid request is never retried automatically. A client request id runs at most once, so a resubmission cannot cause a second charge.
• Contacting Google at all (even the free model list) happens only on an explicit "Check connection". Nothing runs at startup or in automated tests. Browser tests start the server with a placeholder key.
• Mutating routes require the x-precisionedit-client header. Browsers must preflight that header, and the server never answers CORS preflights, so other websites cannot trigger jobs.
• Uploads are size-limited (PRECISIONEDIT_AI_MAX_UPLOAD_MB, default 200). Uploaded files are deleted from Google after each job (they also expire after 48 h). Results are held in memory, bounded.
• The estimated-cost ledger (.precisionedit/ledger.json, git-ignored) holds model, operation, duration and estimated cost. It does not hold prompts or keys. Google's bill is authoritative.

Every segmentation and generative provider must declare its data flow (in-browser, local-server, third-party). The UI must disclose this before any frame leaves the device.

• Never commit credentials. .env* is git-ignored. Only .env.example files with placeholders are allowed.
• Provider API keys live on a server or local backend, never in browser bundles or logs.
• Media-processing commands are spawned with argument arrays (execFile), never shell strings.
• Server-side jobs enforce size and duration limits and clean up temporary files (see AI server rules).

This project is in private development. Report suspected vulnerabilities privately to the maintainer rather than in a public issue.