| Version | Supported |
|---|---|
| 0.x | ✅ |
Please do not open a public GitHub issue for security vulnerabilities.
Report vulnerabilities privately via GitHub's private vulnerability reporting (Security → Report a vulnerability).
Include:
- Description and potential impact
- Steps to reproduce
- Affected version(s)
Response time: I aim to acknowledge reports within 7 days and publish a fix within 30 days for confirmed vulnerabilities.
Niles is designed as a self-hosted local AI butler. Key security properties:
- All data stays on your server — no third-party data sharing
- Passwords hashed with Argon2id
- CSRF protection on all state-changing routes
- SQL injection prevented via parameterized queries (asyncpg)
- CSP with per-request nonces (
'strict-dynamic') - Session cookies:
httpOnly,secure,SameSite=Lax - Per-user credentials encrypted with Fernet (AES-128-CBC + HMAC)
- Rate limiting on authentication endpoints
- No-delete policy — data is never silently removed
In scope: authentication, session management, data access controls, injection vulnerabilities, credential handling.
Out of scope: denial-of-service attacks on self-hosted instances, issues requiring physical access to the server.