We release patches for security vulnerabilities for the following versions:

Please DO NOT report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please report it by:

1. Email: Send details to security@aifiles.dev
2. GitHub Security Advisory: Use GitHub's private vulnerability reporting

Please include the following information in your report:

• Type of vulnerability (e.g., XSS, SQL injection, path traversal)
• Full paths of source file(s) related to the issue
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium: 30-90 days
  • Low: Best effort

When using AIFiles, follow these security guidelines:

DO:

• ✅ Store API keys in ~/.aifiles with proper file permissions
• ✅ Use environment variables for automation
• ✅ Rotate API keys periodically
• ✅ Use different API keys for development and production

DON'T:

• ❌ Commit API keys to version control
• ❌ Share API keys in public forums or issues
• ❌ Include API keys in screenshots or logs
• ❌ Use the same key across multiple applications

DO:

• ✅ Validate file paths before processing
• ✅ Use absolute paths when possible
• ✅ Ensure proper file permissions
• ✅ Check file types and sizes

DON'T:

• ❌ Process files from untrusted sources without validation
• ❌ Allow arbitrary file path input
• ❌ Ignore file permission errors
• ❌ Process files outside intended directories

DO:

• ✅ Set proper file permissions on ~/.aifiles (chmod 600)
• ✅ Review configuration before using untrusted templates
• ✅ Validate configuration values
• ✅ Keep configuration files backed up securely

DON'T:

• ❌ Make configuration files world-readable
• ❌ Store sensitive data in template descriptions
• ❌ Use configuration from untrusted sources
• ❌ Leave default/example API keys in configuration

DO:

• ✅ Use HTTPS for all API calls
• ✅ Verify SSL certificates
• ✅ Use secure local LLMs when privacy is critical
• ✅ Monitor network traffic for anomalies

DON'T:

• ❌ Disable SSL verification
• ❌ Send sensitive files to cloud APIs without encryption
• ❌ Trust unverified API endpoints
• ❌ Ignore certificate warnings

DO:

• ✅ Keep Tauri updated to latest version
• ✅ Use context isolation
• ✅ Sanitize all user inputs
• ✅ Validate all IPC messages

DON'T:

• ❌ Disable web security features
• ❌ Use nodeIntegration: true in renderer
• ❌ Execute untrusted code
• ❌ Load remote content without validation

AIFiles includes the following security features:

1. Path Traversal Prevention

   • Validates all file paths
   • Prevents access to parent directories
   • Rejects suspicious patterns

2. API Key Protection

   • Never logs API keys
   • Redacts keys in error messages
   • Validates key formats before use

3. Input Validation

   • Validates configuration values
   • Sanitizes user inputs
   • Checks file types and sizes

4. Sandboxed Execution

   • Tauri renderer process is sandboxed
   • Context isolation enabled
   • No arbitrary code execution

1. File Permissions

   chmod 600 ~/.aifiles
   chmod 600 ~/.aifiles.json
   chmod 700 ~/.aifiles-templates.json

2. Network Isolation (for maximum privacy)

   # Use Ollama for 100% local processing
   LLM_PROVIDER=ollama
   LLM_MODEL=llama3.2

3. Audit Logging (optional)

   # Enable debug logging for audit trail
   export DEBUG=aifiles:*
   aifiles file.pdf 2>&1 | tee -a ~/aifiles-audit.log

When using cloud-based AI providers:

• Files are sent to third-party APIs
• Content may be used for model training (check provider ToS)
• Metadata may be logged by providers
• Network traffic may be intercepted

Mitigation: Use local LLMs (Ollama) for sensitive data.

During processing:

• Temporary files may be created
• File content is stored in memory
• Intermediate results may be cached

Mitigation: Process sensitive files on encrypted drives.

File notifications may include:

• File names
• Partial content summaries
• Template information

Mitigation: Disable notifications for sensitive workflows.

Before using AIFiles in production:

• API keys are properly secured
• Configuration files have correct permissions
• Using appropriate LLM provider for data sensitivity
• File paths are validated
• GUI is running latest version
• System dependencies are up to date
• Network security is configured
• Audit logging is enabled (if required)
• Team members are trained on security practices

Security updates are released as:

• Patch versions for security fixes (e.g., 2.0.1)
• Security advisories for critical issues
• Changelog entries marked with [SECURITY]

Subscribe to:

• GitHub Security Advisories
• Release notifications
• Project discussions

• Security Email: security@aifiles.dev
• General Issues: GitHub Issues
• Security Advisories: GitHub Security

We appreciate responsible disclosure. Security researchers who report valid vulnerabilities will be:

• Acknowledged in release notes (unless anonymity is requested)
• Listed in SECURITY_HALL_OF_FAME.md
• Given credit in security advisories

• OWASP Top 10
• Node.js Security Best Practices
• Tauri Security
• GitHub Security Features

Last Updated: January 2025 Next Review: July 2025

Thank you for helping keep AIFiles and our users safe! 🔒