Do not open a public GitHub issue for security vulnerabilities.

Please report security vulnerabilities by emailing security@betterup.co. Include as much detail as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any relevant logs, screenshots, or proof-of-concept code
• Your preferred contact method for follow-up questions

You can also use GitHub's Private Security Advisories feature to report a vulnerability confidentially — click "Report a vulnerability" on the Security tab of this repository.

We aim to:

• Acknowledge your report within 2 business days
• Triage and assess severity within 5 business days
• Communicate a remediation timeline once the issue is confirmed
• Notify you when a fix is released

We follow responsible disclosure: we ask that you refrain from publicly disclosing the vulnerability until we have had a reasonable opportunity to address it.

lomon reads Claude Code session files from your local ~/.claude/projects directory. It makes no outbound network calls — all traffic is between your browser and the local backend process. Please consider the following when assessing scope:

• In scope: Path traversal, privilege escalation, data exposure via the local HTTP API, dependency vulnerabilities
• Out of scope: Issues in Claude Code itself (report those to Anthropic), social engineering, attacks requiring physical access to the user's machine

Only pull lomon from the official betterup/lomon-os repository. The MIT license permits anyone to fork and redistribute modified versions. Verify the source before installing.