We release patches for security vulnerabilities. Currently supported versions:

The TalkCody team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email to: kaisenkang@talkcody.com

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the following information in your report:

• Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

This information will help us triage your report more quickly.

• We will acknowledge your email within 48 hours
• We will provide a more detailed response within 7 days
• We will work with you to understand and validate the issue
• We will keep you informed about our progress
• We will credit you in the security advisory (unless you prefer to remain anonymous)

• Never commit API keys to version control
• Use the .env file for storing API keys (already in .gitignore)
• Rotate your API keys regularly
• Use separate API keys for development and production

• All conversations and data are stored locally in SQLite
• Database location: ~/Library/Application Support/com.talkcody.app/
• No data is sent to TalkCody servers (only to your configured AI providers)
• Back up your data regularly

• Only install MCP servers from trusted sources
• Review MCP server permissions before installation
• MCP servers have access to your local file system
• Remove unused MCP servers

When using AI providers:

• OpenAI, Anthropic, Google, etc. API keys are stored in macOS Keychain
• API keys are encrypted at rest
• Keys are only transmitted directly to the respective AI providers
• TalkCody does not log or store API responses containing sensitive data

TalkCody requires file system access to:

• Read and write project files
• Execute bash commands
• Search code repositories

Mitigation:

• TalkCody uses macOS sandboxing
• Path security checks prevent directory traversal attacks
• User confirmation required for destructive operations

When using AI models:

• Models may generate code with security vulnerabilities
• Always review AI-generated code before executing
• Don't share sensitive information in prompts
• Use code analysis tools on AI-generated code

The Agent and Skills Marketplace:

• Community-contributed agents and skills are not vetted by TalkCody
• Review agent/skill code before installation
• Report malicious agents/skills immediately
• We reserve the right to remove harmful content

Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be announced via:

• GitHub Security Advisories
• Release notes
• GitHub Discussions

We currently do not have a bug bounty program, but we deeply appreciate responsible disclosure and will publicly acknowledge your contribution (with your permission).

TalkCody has not yet undergone a formal security audit. We plan to conduct one as the project matures.

• OWASP Desktop App Security
• Tauri Security Documentation
• Electron Security Best Practices

If you have questions about this security policy, please open a GitHub Discussion or contact us at kaisenkang@talkcody.com.

Original upstream project: https://github.com/talkcody/talkcody

Last Updated: 2025-11-30