We provide security updates for the latest minor release of each major version.

Do not open a public issue for security vulnerabilities.

Instead, report them privately via:

• Email: security@wildfirebill.ai
• GitHub Security Advisories: Private vulnerability reporting

Include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Suggested fix (if any)

We aim to:

• Acknowledge within 48 hours
• Provide initial assessment within 7 days
• Release a fix within 30 days for critical issues

Transparency first: known weaknesses and accepted risks are documented publicly in VULNERABILITIES.md — including prompt-injection exposure, the unauthenticated server, and Docker socket implications. Read it before deploying beyond localhost.

LocalAI Code Editor is built on a local-first architecture:

• No external network calls unless explicitly configured by the user
• No telemetry, analytics, or tracking — ever
• No automatic updates that could execute untrusted code
• No cloud dependencies for core functionality

The AI agent operates with explicit user consent:

The agent cannot access paths matching protectedPaths in config (default: [".git"]). This prevents:

• Credential leakage (.env, .npmrc, SSH keys)
• Repository corruption
• Unintended modifications to sensitive files

• No secrets in config — Use environment variables or secure secret stores
• Config validation — All config parsed with strict schema validation
• No eval/exec — Config is data-only, never executed as code

Mounting /var/run/docker.sock grants root-equivalent control over the Docker host to the container. Because the AI agent can run arbitrary shell commands, anything reaching the editor's web UI could take over your host.

Safe alternatives:

Never expose the editor's UI to the internet while the Docker socket is mounted.

The Docker image:

• Runs as non-root user (node:22-alpine)
• Uses multi-stage builds (minimal runtime image)
• No unnecessary packages
• Health checks for orchestration
• Read-only root filesystem (where possible)

The following are never committed:

• API keys (OpenAI, Anthropic, etc.)
• Database passwords
• SSH keys, certificates
• Docker registry credentials
• CI/CD tokens

1. Use .env files (gitignored) for local development
2. Use secret managers in production (1Password, Vault, AWS Secrets Manager)
3. Rotate keys regularly
4. Use least-privilege credentials

• All dependencies pinned in pnpm-lock.yaml
• pnpm install --frozen-lockfile in CI
• pnpm audit runs in CI pipeline
• Dependabot configured for automated updates

• All GitHub Actions pinned to SHA or major version
• Actions reviewed before upgrades
• Minimal permissions (contents: read, packages: write)

• Multi-stage Docker builds with --platform
• SBOM generation (planned)
• Image signing with cosign (planned)

1. Triage — Assess severity, impact, exploitability
2. Contain — Disable affected feature, deploy hotfix if needed
3. Fix — Root cause analysis, patch development, testing
4. Release — Security patch release, advisory publication
5. Postmortem — Public retrospective (for Critical/High)

• No hardcoded secrets in code
• Input validation on all user inputs
• No eval(), Function(), or dynamic code execution
• Path traversal protection on file operations
• Command injection prevention on shell commands
• Proper error handling (no stack traces to user)
• Dependencies updated, no known vulnerabilities
• Tests cover security-relevant code paths

• Security Email: security@wildfirebill.ai
• PGP Key: Available on request
• Security Advisories: GitHub Security

LocalAI Code Editor is designed to support compliance with:

• GDPR — No personal data collection
• SOC 2 — No external data transmission by default
• ISO 27001 — Security controls aligned with best practices

This is not legal advice. Consult your compliance officer for your specific requirements.