Do NOT open a public issue for security vulnerabilities.

We take security seriously. If you discover a vulnerability, please report it responsibly:

Use the "Report a vulnerability" button under the Security tab of this repository. This creates a private advisory that only maintainers can see.

Email: amit.vikramaditya@icloud.com

Please include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Suggested fix (if any)

Vikram employs multiple layers of security:

• Local-first: Your API keys and data never leave your machine
• Command sandboxing: Shell commands go through an allowlist-based security middleware
• Path traversal protection: Workspace restriction prevents directory escapes
• Hardware permissions: Explicit opt-in required for camera, microphone, SMS, location, etc.
• Deny-by-default: Dangerous patterns (rm -rf /, sudo, fork bombs) are blocked
• Secret scanning: GitHub secret scanning and push protection enabled
• Dependency auditing: Dependabot monitors all dependencies (Go, Python, npm, GitHub Actions)
• CodeQL analysis: Automated code scanning on every push and pull request

The following are in scope for security reports:

• Command injection / sandbox escapes
• Path traversal bypasses
• API key leakage
• Privilege escalation
• Authentication bypasses
• Cross-channel message injection

• Denial of service via resource consumption (self-hosted tool)
• Issues in third-party LLM providers
• Social engineering attacks