PromptFix is a local-only tool. The HTTP service (promptfix service) binds exclusively to 127.0.0.1 and is not reachable from other devices or the internet.

• Prompts are sent to your configured AI provider (Groq, OpenAI-compatible, or Ollama).
  If you use Ollama, no data leaves your machine.
• History and cache are stored only on your local disk under ~/.promptfix/.
• No telemetry, analytics, or crash reporting is collected.

• The service token (config.yaml → service.token) is optional but recommended when the browser extension is in use. Without it, any process on your machine can call the service.
• The extension manifest currently uses http://127.0.0.1:*/* as a host permission (wildcard port). A future release will pin this to port 52849.
• <all_urls> content script permission is used for context extraction. A future release will remove this when the context feature is made opt-in.

All dependencies are pinned in pyproject.toml. Run pip-audit to check for known CVEs:

pip install pip-audit
pip-audit

Please do not open a public GitHub issue for security vulnerabilities.

Instead, email the maintainer directly (see pyproject.toml for contact) or use GitHub private vulnerability reporting.

Expect an acknowledgement within 72 hours. We aim to release a patch within 14 days for critical issues.