Model card: authentication is optional via SPLASH_API_KEY

README.md

@@ -57,8 +57,8 @@ installed from another terminal:
 splash opencode    # or: splash claude / splash codex / splash hermes
 ```
 
-The server binds `127.0.0.1` and has no authentication, so put a proxy in
-front of it before exposing it to a network.
+The server binds `127.0.0.1`, and authentication is off by default. Set
+`SPLASH_API_KEY` before exposing it beyond your Mac.
 
 The API is OpenAI Chat Completions and Responses, and Anthropic Messages, with
 streaming, tool calls, JSON Schema output, images, and inline PDFs:
@@ -95,8 +95,8 @@ in each cell is against the next-fastest engine we measured.
 | Aggregate decode · 4 concurrent 32K prompts | 236 tok/s (3.8×) |
 
 Splash led on every measure at every prompt length we tested, and the lead
-grows with load. The cached figure replays the prompt exactly, so a real turn also pays for the
-tokens it adds. The [launch
+grows with load. The cached figure replays the prompt exactly, so a real turn
+also pays for the tokens it adds. The [launch
 post](https://inco.ai/blog/splash/) has the method and the full comparison.
 
 ## Package contents