runeandClaude Sonnet 5
b9c3c97dc0
Points reporters to the contact form at oai.pm instead of public issues. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in oAI, please report it privately rather than opening a public GitHub issue.
|
|
|
|
To report a security concern, use the contact form at **[https://oai.pm/#contact](https://oai.pm/#contact)**.
|
|
|
|
Please include as much detail as possible:
|
|
- A description of the vulnerability and its potential impact
|
|
- Steps to reproduce the issue
|
|
- The oAI version and macOS version you're using
|
|
- Any relevant logs (`~/Library/Logs/oAI.log`), with sensitive data redacted
|
|
|
|
## Scope
|
|
|
|
oAI is a native macOS app that stores conversations, settings, and API keys locally (SQLite database and Keychain). Areas of particular interest for security reports include:
|
|
- API key handling and Keychain storage
|
|
- MCP file access permission checks
|
|
- Bash execution approval flow
|
|
- Any path that could lead to data exfiltration or unauthorized local file/system access
|
|
|
|
## Response
|
|
|
|
Reports submitted through the contact form will be reviewed and acknowledged as soon as possible. Please allow time for a fix to be developed and released before any public disclosure.
|