# Security and privacy

Localhost transport, no telemetry, OS-encrypted credentials, and explicit workspace permissions.

Canonical: https://panevibe.com/docs/security-and-privacy/
Source: https://github.com/brandonmlicea/panevibe

## Local by default

- The bridge binds to 127.0.0.1 on a random free port.
- No analytics, crash reporting, license checks, account, or phone-home path ships in the desktop app.
- Provider calls go directly from your machine to the endpoint you configured.
- Credentials are encrypted at rest with operating-system-native storage.

## Workspace permissions

Project workspaces default to write access; business document workspaces default to read. Read-only sessions reject known write commands before the CLI sees them and can be reinforced by CLI policy and a read-only filesystem mount in runner mode.

There is no in-session unlock. Reopen the workspace with a changed permission to make escalation explicit.

## Report vulnerabilities privately

Do not open a public issue for a vulnerability. Follow SECURITY.md in the source repository for the current private reporting channel.