FreeToken stores your provider API keys encrypted with your own VAULT_MASTER_KEY and runs on your machine. If you find a vulnerability — for example a way to read someone's keys or bypass sign-in — please don't open a public issue. Use GitHub's private vulnerability reporting (the Security tab → Report a vulnerability) so it can be fixed before it's disclosed.