If you discover a security or privacy issue, please do not publish sensitive details in a public issue.

For EIGA, treat imported Letterboxd exports as personal data.

Expected protections include:

• browser-local processing in V1
• no secret values committed to source control
• no raw media history in production logs
• validation of imported files
• safe rendering of imported text
• explicit review of all future third-party data flows