# Security policy

This is a pre-release application without an externally audited security guarantee. Do not use it as an isolation boundary for hostile executables. The app deliberately disables arbitrary terminal execution, remote plugins, and paid actions.

## Reporting

The owner has not configured a public vulnerability mailbox or repository. Do not post secrets or private files to a public issue. Before release, the owner must enable private vulnerability reporting and publish a monitored contact in this file. During local development, record reproducible findings in a private copy of the repository and notify the owner through an already authorized channel.

## Boundaries

- Sandboxed renderer; no Node integration; context isolation and explicit IPC allowlist.
- Local-only inference on 127.0.0.1 with a fresh random API token.
- Pinned HTTPS model distribution and full model checksum validation.
- Folder selection grants a project boundary, not access to all personal files.
- Traversal, alternate data streams, device paths, symlinks, junctions, hard links, and known credential files rejected by project tools.
- Proposed changes use one-time expiring approvals, stale-file checks, and conditional rollback.
- Imported data never restores tool or directory permissions.
- Tool results are data, never new authorization.
- No untrusted shell execution or marketplace workloads.

See [security findings and tests](/reference/docs/security.md) and [verification](/reference/docs/VERIFICATION.md). Dependency audits must be rerun before public release. A clean npm production audit alone does not establish native binary or model parser safety.