OfficeFlow is designed for local, user-reviewed office automation. It does not require an API or upload documents by default.

Do not open untrusted documents in automated workflows. Review every generated document, presentation, spreadsheet, and email draft before sharing or sending it. Never place confidential files, credentials, or personal data in public issues.

The Outlook agent creates .eml drafts only. It does not send mail automatically. A future integration that sends email must require explicit user confirmation and least-privilege credentials.

Report suspected vulnerabilities privately through the repository's GitHub security contact rather than disclosing them in a public issue.