Local-Ai Agent is designed to run locally on user hardware with zero-daemon overhead. Because the agent interacts with local shell execution, workspace files, and system tools, we maintain a Zero-Trust Security Boundary:

1. Confirmation Gates (/g): Potentially destructive operations (file modifications, shell command execution) default to explicit user authorization prompts unless explicitly bypassed by the user.
2. Workspace Containment: File tool operations are constrained to the active workspace directory unless explicit out-of-bounds permission is granted.
3. Local Privacy: No telemetry, conversation history, or personal API keys are uploaded to centralized analytics servers.

We actively provide security updates for the following versions:

If you discover a security vulnerability, path traversal flaw, or command injection issue in Local-Ai Agent, please do not open a public GitHub issue.

Please report the vulnerability privately via email:

• Email Contact: j5onrf@gmail.com (j5onrf [at] gmail [dot] com)
• Subject Requirement: Please prefix the subject line with [github] so our automated security triage agent processes it immediately (e.g., [github] [security] Vulnerability Report).

Alternatively, submit a private advisory via GitHub Security Advisories.

• Acknowledgement: Within 48 hours.
• Patch Release: Target within 7 to 14 days.
• Credit: Recognized in release notes upon publication.