Please report security issues privately, not in public issues or pull requests.

Use GitHub's private vulnerability reporting: the Security tab of this repository → Report a vulnerability. If that is unavailable to you, open a minimal public issue asking for a private contact channel (without details), and the maintainer will follow up.

Please include enough to reproduce: affected version/commit, configuration, and a proof of concept if you have one. We aim to acknowledge reports within a few days.

This project is pre-1.0 (alpha). Security fixes are made against main; there are no backported release branches yet.

OkComputer is a harness that runs an LLM against local tools. When you run it, be aware:

• It executes tools and shell commands in a workspace. Treat any workspace you point it at, and any model/provider you configure, as capable of reading and modifying files there. Run untrusted tasks in a sandbox or throwaway directory. --allow-dangerous-tools widens this deliberately.
• Secrets come from the environment. Provider API keys are read from env / .env (which is git-ignored) and are never written to logs, traces, or persisted state. Error messages are scrubbed to avoid leaking provider secrets. Do not commit real keys; .env.example is the template.
• Prompt injection is in scope. Tool output and file contents can contain adversarial instructions. The harness treats observed content as data, and the self-improvement loop screens proposed prompt overlays for injection/secret patterns before they can be accepted. Reports of bypasses are welcome.
• The self-improvement loop is proposal-first. Mined weaknesses and proposed harness edits never auto-apply; a human accepts them, and application is gated behind an explicit per-workspace toggle. A path that lets a proposal take effect without that human step is a security issue.

Reports that amount to "if you give the model a dangerous tool and an adversarial task, it can do damage" are expected behavior, not vulnerabilities — but a way to escape the documented boundaries (e.g. secret leakage, applying an unaccepted edit, escaping the workspace sandbox) is.