lemonade

The server binds to `localhost` by default, which is safe; however, if configured to bind to `0.0.0.0`, it would expose the API externally. The API lacks authentication by default if the `LEMONADE_API_KEY` environment variable is not set, posing a risk if exposed. Cross-Origin Resource Sharing (CORS) is enabled for all origins (`*`), a common practice for local development but a potential vulnerability for externally-exposed servers. It automatically downloads model backends and LLM models from trusted GitHub and Hugging Face repositories, which can introduce supply chain risks if these sources are compromised, though it utilizes version pinning and explicit URLs. On Windows, the build incorporates Control Flow Guard, ASLR, and DEP. Linux builds are headless-only and use permissively licensed dependencies.