Security.

Reporting a security issue

Email admin@lomi.dev with “Security report” in the subject. Please include:

• A short description of the issue and what an attacker could do.
• Steps to reproduce, including a minimal proof of concept if you have one.
• The affected Lomi version, operating system and architecture.

Use test data and accounts you control. Do not include API keys, passwords, private project files or other people's data. Please do not open a public issue until we have had a chance to investigate.

What to report

Reports are most useful when they show a security impact in Lomi or a Lomi service, for example:

• Unauthorized access to files, credentials, terminals, accounts or shared workspaces.
• A way for untrusted content to cross the desktop app's permission boundaries.
• Issues in account sign-in, Remote access, the update process or release artifacts.
• A vulnerability on lomi.dev that could expose data or compromise downloads.

For an issue in an upstream library or provider, please also report it to that project. Let us know if Lomi's integration makes the impact worse.

Versions and fixes

Use the latest release when reproducing an issue. Security fixes are announced in release notes. We do not promise a fixed support window or backports for older versions.

Security in Lomi

• API keys and remembered account sessions use your operating system's credential store when it is available.
• In-app update packages are verified before installation. The release process also runs security regression checks across supported desktop platforms.
• Local workspace data stays on your device during local use. AI, account and Remote features can send data to the services needed to provide them; see the privacy policy.

Security boundaries

Lomi's terminal runs commands with your operating system user permissions. Programs, agents and plugins may read or change anything those permissions allow. Review commands, plugin sources and requested access before you use them.

AI providers receive the prompts, context and files you send to them. A local model endpoint is trusted by your machine, so connect only to endpoints you control or trust. Lomi does not sandbox an arbitrary command or make third-party tools safe.

Contact

For a private report, email admin@lomi.dev. Source code and releases are available on GitHub.