Please use GitHub private vulnerability reporting or email security@archastro.ai. Include:

• the affected Redline version or commit
• the operating system and browser
• reproduction steps
• impact and any proof-of-concept details

Please do not open a public issue for vulnerabilities until we have had a chance to investigate.

Redline runs a local sidecar on 127.0.0.1 and stores redline data under ~/.redline by default. Redlines can include selected text, comments, page URLs, page titles, DOM snippets, and screenshots. This data is local to the machine unless you share it or configure tooling that exports it.

The sidecar only accepts browser-originated requests from Chrome extension origins that also present the capability token generated by redline setup. The token is stored at ~/.redline/auth-token with owner-only permissions and injected into the synced unpacked extension. Command-line tools without an Origin header can still access the sidecar locally.