Please do not open a public issue for security problems.
Report privately via GitHub's private vulnerability reporting (the Security → Report a vulnerability tab on this repository). Include what you found, how to reproduce it, and the impact you expect. We aim to acknowledge reports within a few days.
Mosaic is a local-first, single-user application. It is designed to run on your own machine, for you, and its security posture reflects that:
- Everything binds to
127.0.0.1. The backend (:6969) and the ActivityWatch store (:5600) listen on localhost only. There is no authentication because there is no intended network surface — do not expose these ports to a network or bind them to0.0.0.0. Doing so exposes your activity data with no access control. - Capture and storage stay on your machine. Window titles, URLs, screenshots,
and OCR text are stored locally under
~/.local/share/mosaic/. - The only outbound data is the coaching LLM call, and only when a cloud
provider (e.g. OpenRouter) is selected. Local providers (
ollama,claude_code,mock) send nothing to a third-party API. - Redaction is the privacy chokepoint. When enabled, matching apps, window
titles, and domains are stripped before the data is summarised or sent to any
model. Redaction is configured in
~/.config/mosaic/redaction.tomland via the Settings page. If the file is absent, redaction is off and activity reaches the model unfiltered — the app warns when this is the case. - Secrets (e.g.
OPENROUTER_API_KEY) live in~/.config/mosaic/mosaic.env, outside the repository, and should bechmod 600. Never commit them.
- A default configuration that leaks activity data off-device without consent.
- Redaction that fails to strip data it is configured to strip.
- Path traversal, injection, or any way for a local web page (via the browser) to read files or data it shouldn't through the localhost API.
- Secrets written to logs, exports, or anywhere world-readable.
- Issues that require an attacker who already has local access to your user
account (they can already read
~/.local/share/mosaic/directly). - Exposure caused by deliberately binding the services to a public interface.
Mosaic is pre-1.0; only the main branch is supported. Please test against the
latest main before reporting.