Skip to content

Security: PRN-6/PRIVACY68

Security

SECURITY.md

Security Policy & Privacy Architecture

PRIVACY68 is engineered from the ground up as a 100% local, privacy-first AI voice assistant. Security and data isolation are core principles of the architecture.


🔒 Supported Versions

We actively release security patches and improvements for the following versions of PRIVACY68:

Version Supported
1.3.x ✅
1.2.x ✅
1.0.x ✅
< 1.0 ❌

🛡️ Security Architecture & Privacy Commitments

  1. Zero Cloud Audio Transmission

    • Audio processing, wake word detection (Silero VAD / Faster-Whisper), and local LLM inference (Ollama) run entirely on your local machine (127.0.0.1).
    • No voice recordings, transcripts, or telemetry are uploaded to remote servers.
  2. Biometric Voice Authentication Data

    • Speaker recognition profiles and voice embeddings generated by PyTorch / SpeechBrain are stored locally in secure app directories.
    • Embeddings are non-reconstructible mathematical representations of acoustic features used solely for local verification.
  3. Local API & Remote Server Binding

    • The WebSocket/HTTP bridge for the Web UI and remote commands binds only to 127.0.0.1 by default.
    • External network access requires explicit configuration and authentication keys.
  4. Action Execution Guardrails

    • The Fast Lane and Computer Use execution modules enforce strict input sanitization to prevent shell injection or unauthorized system operations.

🚨 Reporting a Vulnerability

If you discover a potential security vulnerability or privacy bug in PRIVACY68, please report it responsibly:

  1. Do NOT open a public GitHub issue for undisclosed security vulnerabilities.
  2. Contact via GitHub Security Advisory: Navigate to the Security tab of this repository and click "Report a vulnerability" (Draft a private security advisory).
  3. Alternatively, email the maintainers directly at security@privacy68.local (or submit a private security advisory).

What to Include in Your Report

  • A description of the issue and potential risk.
  • Step-by-step instructions to reproduce the vulnerability (proof of concept).
  • The operating system, Python version, and PRIVACY68 version used.

Response Timeline

  • Acknowledgement: Within 48 hours.
  • Triage & Status Update: Within 5 business days.
  • Fix & Disclosure: Coordinated patch release upon verification.

Thank you for helping keep PRIVACY68 safe and private for everyone!

There aren't any published security advisories