| 1 | # Security Policy |
| 2 | |
| 3 | Siti AI is a privacy product. We take security and privacy reports seriously and |
| 4 | appreciate responsible disclosure. |
| 5 | |
| 6 | ## Privacy & threat model |
| 7 | |
| 8 | Siti is designed so that **chat content is processed entirely on-device**: |
| 9 | |
| 10 | - The language model runs locally via the [Onde](https://ondeinference.com) |
| 11 | engine. Prompts and generated text are **not** sent to Splitfire AB or any |
| 12 | third party for inference. |
| 13 | - Model files are downloaded from public model hosts (e.g. Hugging Face) on |
| 14 | first use and cached locally. That download is the primary outbound network |
| 15 | activity related to the model. |
| 16 | - There is no account and no server-side chat storage. |
| 17 | |
| 18 | What this policy is most interested in: |
| 19 | |
| 20 | - Any path by which chat content, prompts, or user data leave the device |
| 21 | unexpectedly. |
| 22 | - Sandbox escapes, insecure IPC between the UI and the Rust core, or unsafe |
| 23 | handling of downloaded model files. |
| 24 | - Supply-chain or build-integrity issues (dependency, signing, or release). |
| 25 | |
| 26 | ## Reporting a vulnerability |
| 27 | |
| 28 | **Please do not open a public GitHub issue for security reports.** |
| 29 | |
| 30 | Preferred: use **GitHub → Security → "Report a vulnerability"** (private |
| 31 | advisory) on this repository. |
| 32 | |
| 33 | Alternatively, email **privacy@getsiti.5mb.app**. If you'd like to encrypt, |
| 34 | request our PGP key in your first message. |
| 35 | |
| 36 | Please include: |
| 37 | |
| 38 | - A description of the issue and its impact. |
| 39 | - Steps to reproduce (proof-of-concept if possible). |
| 40 | - Affected version / platform (macOS, iOS, Android) and build. |
| 41 | |
| 42 | ## What to expect |
| 43 | |
| 44 | - **Acknowledgement:** within 3 business days. |
| 45 | - **Assessment & triage:** we'll confirm the issue and share our planned fix and |
| 46 | timeline. |
| 47 | - **Disclosure:** coordinated. We'll credit you in the advisory unless you prefer |
| 48 | to remain anonymous. |
| 49 | |
| 50 | ## Scope |
| 51 | |
| 52 | In scope: this repository (the Siti app) and its build/release pipeline. |
| 53 | |
| 54 | The inference engine lives in its own repo — report engine issues at |
| 55 | <https://github.com/ondeinference/onde>. Model weights themselves are |
| 56 | third-party; report those to their respective publishers. |
| 57 | |
| 58 | Thank you for helping keep Siti users safe. |