SECURITY.md
Rama main · réplica de lectura del repositorio original.
# Security Policy
## Security Model & Zero-Trust Principles
`Local-Ai Agent` is designed to run locally on user hardware with zero-daemon overhead. Because the agent interacts with local shell execution, workspace files, and system tools, we maintain a **Zero-Trust Security Boundary**:
1. **Confirmation Gates (`/g`):** Potentially destructive operations (file modifications, shell command execution) default to explicit user authorization prompts unless explicitly bypassed by the user.
2. **Workspace Containment:** File tool operations are constrained to the active workspace directory unless explicit out-of-bounds permission is granted.
3. **Local Privacy:** No telemetry, conversation history, or personal API keys are uploaded to centralized analytics servers.
---
## Supported Versions
We actively provide security updates for the following versions:
| Version | Supported |
| :--- | :--- |
| `v0.9.x` (Beta) | :white_check_mark: |
| `< 0.9.0` | :x: |
---
## Reporting a Vulnerability
If you discover a security vulnerability, path traversal flaw, or command injection issue in `py-agent`, **please do not open a public GitHub issue.**
Please report the vulnerability privately via email:
- **Email Contact:** <a href="mailto:j5onrf@gmail.com">j5onrf@gmail.com</a> (`j5onrf [at] gmail [dot] com`)
- **Subject Requirement:** Please prefix the subject line with **`[github]`** so our automated security triage agent processes it immediately (e.g., `[github] [security] Vulnerability Report`).
Alternatively, submit a private advisory via [GitHub Security Advisories](https://github.com/j5onrf/local-ai/security/advisories/new).
---
## Response Timeline
- **Acknowledgement:** Within **48 hours**.
- **Patch Release:** Target within **7 to 14 days**.
- **Credit:** Recognized in release notes upon publication.