Karing configuration files may contain subscription URLs, node credentials, UUIDs, passwords, and the local control API secret.

Never attach these files to an issue:

• service_core.json
• karing_subscribe.json
• karing_subscribe_use.json

Use karing-rule --json doctor for non-secret diagnostics.

Please report a suspected vulnerability privately through GitHub's security advisory feature. Do not open a public issue containing credentials or a full Karing configuration.

The CLI only talks to a loopback Karing control endpoint. It refuses a control address that does not begin with 127.0.0.1 or localhost.