Linha Voice Lab is experimental local-only software, not a hosted service. There is no support SLA or promise of suitability for real outreach. Only the current source is considered for fixes; no long-term supported release line is offered.

If GitHub's Report a vulnerability option is available for this repository, use it for a private report. If it is not available, open a minimal issue asking for a private reporting channel without disclosing exploit details or secrets. Do not assume a private disclosure channel or response deadline exists until confirmed.

Include the affected source revision, OS/runtime versions, a minimal synthetic reproduction, expected versus observed behavior and the boundary crossed. Use local test doubles. Do not make real calls or touch another person's records to prove an issue. Do not attach config files, databases, transcripts, real phone numbers, cookies, provider identifiers or raw runtime logs.

• One trusted administrator on a protected workstation, both listeners on loopback.
• Private Go config and database outside the checkout; no browser/provider secrets.
• No public hosting, tunnel, multi-tenant use or external callback requirement.
• Prompt/model output is untrusted. Backend validation remains authoritative.
• Configured caller-ID flags and eligibility declarations are not independent proof.
• Local deletion cannot remove original spreadsheets, OS backups or carrier records.

See Privacy and safety. If credentials have leaked, revoke them with the provider and remove the exposure; deleting a Git file alone does not revoke a credential. Preserve the fingerprint key with its database—do not replace it as a shortcut around suppression or a startup mismatch.