privacy-hybrid security dashboard

Generated from REMEDIATION_TRACKER.md. Self-assessment by the owner, not an independent audit.

Findings by status

Closed 18
Mostly fixed 0
Open 0
Accepted 2

By severity

Medium

Low

Info

Not rated

By priority

n/a

CI (main)

Checks: tests 3.11/3.13, static, lock, CodeQL, gitleaks, dependencies.

What protects you

✔
Sensitive text is masked or blocked before it leaves
ID numbers, passports and non-US addresses (PH-001, PH-002)
✔
Extreme privacy cannot be undone by accident
older backups and the scheduler respect it (PH-006, PH-007)
✔
Sign-in is hardened
setup code, slow password hashing, throttling per account (PH-004, PH-010, PH-011)
✔
Network traffic is protected
TLS required on the LAN, bodies capped before sign-in (PH-005, PH-009)
✔
Accounts are kept apart
other users get a reduced config view, stable admin succession (PH-013, PH-018)
✔
Nothing readable is kept in memory caches
no document text cached (PH-012)
✔
Tamper-evident audit log
hash chain, private folder, rotation (PH-019)
✔
Cloud helper sends only the prompt
telemetry off, no connectors, checked by capture (PH-020)
✔
Locked-down install
root-run script refused unless owned by root (PH-008)
✔
Supply chain pinned and checked
hashed lock file, pinned Actions, CI scans (PH-014)
✔
Public repo is protected
pull request and green checks required, admins included (PH-015)

Known limits

PH-003 Spelled SSN, non-Latin names: accepted limit
PH-016 In-process egress guard scope: accepted limit
Not yet verified: Real local second-pass model efficacy
Not yet verified: Keychain item access control for the scheduler key
Not yet verified: TLS trust on devices, certificate renewal
Not yet verified: pf lockdown correctness
Not yet verified: Transitive dependency vulnerabilities

Findings

PH-001Closed

Passport numbers missed

Medium · P1 · effort S

Closed

test: test_id_phrasings_block_the_request

PH-002Closed

Non-US addresses not masked

Medium · P1 · effort M

Closed

test: test_non_us_addresses_are_masked

PH-004Closed

No default setup token

Medium · P1 · effort S

Closed

test: test_first_account_from_another_machine_needs_the_setup_code

PH-005Closed

Plain HTTP on LAN allowed

Medium · P2 · effort S

Closed

test: test_lan_bind_requires_tls_or_flag

PH-006Closed

Older file restores undo Extreme privacy

Medium · P1 · effort M

Closed

test: test_restoring_an_older_prefs_file_does_not_switch_extreme_off

PH-007Closed

Scheduler cannot read Extreme setting

Low · P1 · effort M

Closed

test: test_real_slot_account_runs_web_job_and_extreme_still_blocks

PH-008Closed

Root-run script in writable path

Medium · P1 · effort S

Closed

test: test_refuses_non_root_script

PH-009Closed

Body read before auth

Low · P3 · effort S

Closed

test: test_signed_out_post_is_refused_before_the_body_is_read (+1 more)

PH-010Closed

Per-address throttling only

Low · P3 · effort S

Closed

test: test_many_addresses_guessing_one_account_hit_an_account_wide_delay

PH-011Closed

scrypt cost modest

Low · P3 · effort M

Closed

test: test_old_scrypt_accounts_sign_in_and_are_upgraded

PH-012Closed

Plaintext kept in lru_cache

Low · P3 · effort S

Closed

test: test_no_document_text_is_cached_in_the_process

PH-013Closed

Admin succession by mtime

Low · P3 · effort S

Closed

test: test_succession_is_stable_across_a_password_change

PH-014Closed

Unpinned transitive deps, model, Actions

Medium · P1 · effort M

Closed (residual: Dependabot vs lock)

test: lock

PH-015Closed

Repo governance gaps

Low · P2 · effort S

Closed (nothing reaches public main except through a pull request with the four checks green and the owner's merge click, admins included; accepted residual: no signed commits and no independent reviewer, because the owner is the only maintainer)

PH-017Closed

Public threat model stale

Low · P2 · effort S

Closed

test: test_every_cited_threat_exists

PH-018Closed

/api/config visible to all users

Info · P3 · effort S

Closed

test: test_other_users_see_a_reduced_config

PH-019Closed

Log dir permissions, no tamper evidence

Info · P3 · effort S

Closed (log rotates at 10 MB, keeps 12 archives; hash chain continues across a rotation)

test: test_log_dir_is_private (+2 more)

PH-020Closed

Claude CLI traffic beyond stdin

Not rated · P1 (validation) · effort M

Closed (owner-run capture 2026-11-02, three runs; last: the app's setup made one request, to api.anthropic.com; no canary, no telemetry, no connector traffic; control valid)

test: tests/security/test_network.py

PH-003Accepted

Spelled SSN, non-Latin names

Low · P2 · effort M

Accepted (the detector cannot mask spelled-out numbers or non-Latin names; mitigations: the script guard refuses, a "maybe sensitive" warning forces the preview and a second confirmation even with Review off, and the owner sees the text before it leaves; deliberate sharing by the user is out of scope)

test: test_spelled_ssn_and_foreign_id_labels_block_the_request (+4 more)

PH-016Accepted

In-process egress guard scope

Info · n/a · effort n/a

Accepted

Timeline

2026-11-02PH-003 moved to Accepted by the owner's decision, with a new mitigation: a "maybe sensitive" warning (digits spelled out, long unmasked numbers, words like passport or account number) forces the preview and a second "send anyway" confi
2026-11-02PH-015 Closed. enforce_admins turned on for public main (required: pull request, 4 status checks; 0 approvals because a sole owner cannot approve their own pull request). The owner can no longer push straight to main; every change needs a pull request, green c
2026-11-02PH-020 Closed. The app's CLI now runs with a private config folder (when present), telemetry and error reporting off, and no MCP servers or account connectors. Owner-run capture with a valid control (the user-memory canary shows up when settings are allow
2026-11-02PH-019 Closed: the audit log now rotates at 10 MB and keeps 12 archives; the first line of the new file carries the hash of the archive's last line; test test_audit_log_rotates_and_keeps_the_chain. Counts: 16 Closed, 3 mostly fixed (PH-003, 015, 020), 1 A
2026-11-02PH-020 capture run by the owner (mitmproxy, own user, real login, canaries planted in CLAUDE.md and a filename). Result: no canary in any request; prompt text only in the message request. Finding: the CLI also sent usage telemetry and error metadata to Anthrop
2026-11-02PH-008 Closed. Owner-run test on a real root-owned copy at /usr/local/ph008: trusted copy returns True; the user-owned checkout returns False; making the scripts directory group/world-writable returns False. Counts: 15 Closed, 3 mostly fixed, 1 Accepted, 1 Ope
2026-11-02Re-review. PH-008: confirmed the script and all its parents are owned by the app user; added an owner/mode/symlink check on the script and every parent immediately before osascript (local, uncommitted) and 7 tests; the previously cited test_refuses_non_root_sc
2026-11-01Public: PH-011, 017 Closed; PH-003, 019 mostly fixed. PH-015 settings changed on the public repo (secret scanning, push protection, Dependabot security updates, real required check names).
2026-11-01Public: PH-009, 010, 012, 013, 018 Closed; PH-019 partly fixed; PH-014 Closed with residual; pytest moved to requirements-dev.txt. Fix-commit column filled in.
2026-11-01Public CI green. PH-005 Closed; PH-014 partly fixed.
2026-11-01PH-005 and PH-014 fixed in private; pushed to public for CI. PH-008 left open on purpose.
2026-11-01Fixes pushed to public as; CI green. PH-001, 002, 004, 006, 007 set to Closed.
2026-11-01PH-001, 002, 004, 006, 007 fixed in the working tree with regression tests (613 tests pass locally). Not committed; become Closed when merged and green in CI.
2026-11-01Tracker created from the assessment. All items open.

Deeper detail: docs/security.