Please report privately rather than in a public issue. Use GitHub's Report a vulnerability button on the Security tab, or open a normal issue with no details asking for a private channel.

Include what you did, what happened, your OS and the output of deskagent doctor. Never paste an API key, a screenshot of private content, or a log you have not read through first — logs are redacted, but redaction is a backstop, not a guarantee.

Expect an acknowledgement within a week. This is a small project with no paid staff, so fixes ship as fast as one person reasonably can.

deskagent reads the screen, talks to a provider you configure, and — if you turn it on — can click and type. The interesting attack surface follows from that:

• An API key reaching a log file, a crash report, or an outbound request other than the configured provider.
• Screen content leaving the machine when privacy.local_only is set, or being written to disk when vision.save_captures is off.
• Capturing a window whose process is on the blocklist, or one the redaction zones were supposed to cover.
• Any path that performs a click or keystroke without consent plus a confirmation for that specific action, or that defeats one of the hard limits: password fields, the process blocklist, destructive key combinations, the one-action rule, the rate limit, or the panic hotkey.
• Prompt injection from screen content — text on screen that makes the assistant act rather than describe. Treat a report showing this as a real finding: screen content is untrusted input.
• Loading configuration or a model from a location an unprivileged local user can write to.

• A provider returning wrong or unsafe answers. deskagent does not vet model output; that is between you and your provider.
• Anything requiring an attacker who already has code execution as your user. If they can run code as you, they can screenshot your desktop without us.
• Vulnerabilities in Qt, a model runtime, or another dependency. Report those upstream; tell us so we can pin or bump.
• Control mode doing what you confirmed. It is dangerous by design, which is why it is off by default and requires typed consent.

• Keep keys in .env or your OS keychain, never in a YAML file.
• Leave control mode off unless you need it, and read the consent text.
• Review logs/ before attaching one to a bug report.
• If you suspect a key was exposed, rotate it first and report afterwards.