Only the latest release receives security fixes.

Please do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting on this repository. If that is unavailable to you, open a normal issue saying only that you have a security report and asking for a contact address — no details in the issue itself.

Please include:

• What the vulnerability allows an attacker to do
• Steps to reproduce, ideally with a minimal example
• The version, operating system, and whether web search or the image backend were enabled

You can expect an acknowledgement within a week. Because this is a volunteer project there is no guaranteed fix timeline, but you will get a straight answer about whether and when it is being worked on. If you want credit in the release notes, say so and how you would like to be named.

Being precise about what Øxygen does and does not protect against is more useful than a blanket promise.

• Your data does not leave the machine. Conversations, files and settings are stored locally and are only sent to the local Ollama daemon. The only outbound network calls are web search (opt-in, search terms only) and a local image server (opt-in, on loopback).
• Model output is treated as untrusted. Replies are rendered as Markdown, then sanitized with DOMPurify before reaching the DOM. Scripts, inline styles, iframes, and event handler attributes are stripped.
• Links do not navigate the app. External links open in your system browser rather than inside the webview, so a malicious link cannot replace the UI.
• File access is scoped. The asset protocol is limited to the app data directory, and file deletion refuses any path outside that directory.
• Web pages are not trusted. Fetched pages are reduced to text; scripts and markup never execute.

• Anyone with access to your user account. There is deliberately no login. The database is a plain file readable by your operating system user. Anyone who can read your home directory can read your chats. Use full-disk encryption and your operating system's account controls — that is the right layer for this.
• A hostile Ollama endpoint. If you point Øxygen at a remote host in Settings, your prompts go to that host. The default is loopback; changing it is your decision and your risk.
• Malicious models. A model you install can produce misleading output. Sanitization prevents code execution, not bad advice.
• Prompt injection through attachments or web pages. A document or website can contain text designed to steer the model. Øxygen labels retrieved content and cites its sources so you can check, but it cannot detect manipulation.
• Supply chain. Verify what you build and install, as with any software.

• Leave web search off unless you need it, and prefer a self-hosted SearXNG.
• Turn off "Store chats" for sensitive sessions — they then live only in memory.
• Set a retention window in Settings → Data controls.
• Keep Ollama bound to 127.0.0.1 (its default).