From b9c3c97dc0289781705b81541675885c0aef9bef Mon Sep 17 00:00:00 2001 From: Rune Olsen Date: Thu, 16 Jul 2026 09:05:18 +0200 Subject: [PATCH] Add SECURITY.md with vulnerability reporting policy Points reporters to the contact form at oai.pm instead of public issues. Co-Authored-By: Claude Sonnet 5 --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d54b0d3 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +## Reporting a Vulnerability + +If you discover a security vulnerability in oAI, please report it privately rather than opening a public GitHub issue. + +To report a security concern, use the contact form at **[https://oai.pm/#contact](https://oai.pm/#contact)**. + +Please include as much detail as possible: +- A description of the vulnerability and its potential impact +- Steps to reproduce the issue +- The oAI version and macOS version you're using +- Any relevant logs (`~/Library/Logs/oAI.log`), with sensitive data redacted + +## Scope + +oAI is a native macOS app that stores conversations, settings, and API keys locally (SQLite database and Keychain). Areas of particular interest for security reports include: +- API key handling and Keychain storage +- MCP file access permission checks +- Bash execution approval flow +- Any path that could lead to data exfiltration or unauthorized local file/system access + +## Response + +Reports submitted through the contact form will be reviewed and acknowledged as soon as possible. Please allow time for a fix to be developed and released before any public disclosure.