The licence is in LICENSE. The shipped artifact is a SMAPI mod that listens on loopback only and authenticates each command with a per-run token in a user-only state file.

Do not open an issue for a security report. Use GitHub's private vulnerability reporting on this repository, or email opensource@rethunk.tech, with a description, the affected paths or version, the SMAPI version in use, steps to reproduce, and the impact.

Only the latest release is supported; fixes ship in a new release, not as patches to older ones.