Local Transcription is a local-first desktop and CLI project. It processes user-selected media, generated transcripts, local model files, and optional local model endpoints.

Keep these out of Git, screenshots, issues, and logs:

• .env and Hugging Face tokens
• source audio/video files
• generated transcripts, summaries, translations, and diarization output
• model binaries and local tool builds
• private LAN/VPN endpoint names if they reveal internal infrastructure

Before publishing a branch or opening a pull request, run:

git status --short
git check-ignore -v .env data/runs models/whisper/ggml-large-v3-turbo.bin whisper.cpp-vulkan
git grep -n -I -E "(hf_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,}|Bearer [A-Za-z0-9._~+/-]{20,})" -- . ':!Cargo.lock' ':!apps/desktop/pnpm-lock.yaml'

This project intentionally supports local/private model endpoints only. The desktop app accepts loopback, LAN, and VPN-style Ollama URLs such as http://localhost:11434, http://127.0.0.1:11434, or a private host on your trusted network.

Do not add cloud API-key flows unless the project gets a new threat model first. Cloud APIs change the privacy promise, logging expectations, credential storage, abuse handling, and user consent surface.

• Spawn external tools with argument arrays, never shell string concatenation.
• Keep generated artifacts under the configured output directory unless the user chooses an explicit export destination.
• Canonicalize paths before reading, writing, serving, exporting, or deleting generated files.
• Never overwrite source media.
• Do not print secret values from .env.
• Treat downloaded media, transcript text, and LLM output as untrusted data.
• Add focused tests when changing path handling, deletion, export, local HTTP serving, endpoint validation, or subprocess execution.

Please report vulnerabilities privately via GitHub security advisories if available. If that is not available, open a minimal issue without exploit details, secrets, private media, or generated transcripts.