james.maes
9b62db5c33
MIT license (permissive, attribution required); SECURITY.md documents the personal-use threat model and private reporting channels (email + GitHub Security Advisories).
1.0 KiB
1.0 KiB
Security Policy
Reporting a vulnerability
Jarvis is a personal-use macOS application; the threat model assumes a single trusted user. The most likely security-relevant surfaces are:
- AppleScript automation — gated behind a per-call HUD confirmation
(
requiresConfirmation: true); enforced byscripts/check-applescript-confirmation.sh. - Anthropic API key storage — macOS Keychain only; never plaintext.
- Ollama loopback enforcement —
OllamaConfigrejects non-loopback hosts at config load (AGENT-05 in CLAUDE.md). - Hardened Runtime + JIT entitlement — required for WKWebView JavaScriptCore on Apple Silicon.
If you find a vulnerability, report it privately:
- Email: jmaes@dmdbrands.com
- GitHub Security Advisory: https://github.com/KofTwentyTwo/Jarvis/security/advisories/new
Please do NOT open a public issue for security reports. Allow up to 7 days for an acknowledgement.
Supported versions
Only develop is supported. Tagged releases are not yet a thing for this
project.