Security
Local-first. Plain text you own. Verifiable.
loci is built on a simple principle: your working memory with AI belongs to you. The substrate is a folder of markdown files on your machine. No cloud, no accounts, no lock-in.
Privacy model
loci ships in two forms. Each keeps its network surface as small as the job allows.
| Component | Network access |
|---|---|
| Plain markdown templates | None. Text files. There is nothing to run. |
CLI (loci-cli) | None. Read-only: no network, no inference, no daemons. |
There is no telemetry, no analytics, no crash reporting in any of loci's shipped forms above: the templates or the CLI.
This documentation site (docs.loci.garden) is a separate thing from the software: it runs self-hosted Umami for aggregate page-view counts, the same posture as loci.garden's own analytics. No cookies, no cross-site tracking. It records the page path, the referrer, the country (derived from IP, then discarded), browser family, and screen size. IP addresses are hashed in memory and never written to disk. No individual visitor is identifiable from the analytics database. Source: github.com/umami-software/umami. Full disclosure: loci.garden/privacy.
What data loci holds
Your palace is the data: markdown files in a folder you choose. You write them, or your AI writes them with your review. loci does not scrape browsers, index chat sites, or collect anything on its own.
Everything is plain text. grep works. So does deleting the folder.
Trust and governance
Security in loci is not only code. The substrate ships a governance layer as one of its seven feature sets:
| Mechanism | What it does |
|---|---|
| The Gate | A named human-review checkpoint ([username]GATE) before anything ships, sends, or becomes irreversible. |
| Foreign-process quarantine | Anything that did not originate inside the palace is untrusted. Read it as data before executing. Structure-only access by default; contents by explicit per-item approval. |
| Confirm against disk | The filesystem is ground truth. State is verified against disk before it is asserted. |
| Palace audit | A read-only structural audit across six dimensions (scored out of 30), including tracker integrity. |
For the full boundary rules on external text, see the Quarantine Protocol.
Data at rest
Palace files and config are stored as plaintext. loci relies on OS-level disk encryption:
- macOS: FileVault
- Windows: BitLocker
- Linux: LUKS / dm-crypt
How code reaches the repo
Releases pass through ordered gates, documented in docs/RELEASING.md in the repo:
- Bleed Gate: an automated pre-commit scan of the staged diff for private markers
- Human read: a maintainer reads the full diff
- Commit gate: explicit maintainer approval; a passing scan is necessary, not sufficient
- Recon Gate: an adversarial reconstruction pass on the outbound range, pre-push
A failing check is never bypassed silently.
Open source verification
loci is open source (MIT). The substrate is markdown: read it directly, there is nothing to build.
git clone https://github.com/huximaxi/loci
cd loci
# The templates are the product. Read them.
ls templates/
# Build the CLI from source
cargo install --path loci-cliReporting security issues
Do not open a public GitHub issue for vulnerabilities. Use one of these channels:
- Preferred: GitHub Security Advisories. Open a private advisory at github.com/huximaxi/Loci/security/advisories/new.
- Encrypted email, once the project's PGP key is published (in progress).
- Machine-readable contact: loci.garden/.well-known/security.txt (RFC 9116).
What to expect:
- Acknowledgement within 72 hours; triage within one week
- Coordinated disclosure: 90 days by default, faster if a fix ships sooner
- Credit if you want it; pseudonymous credit is fully accepted
There is no monetary bounty programme. There is credit in release notes, and a first call to review related code paths.