Big Brain is designed with a security first and privacy first mindset.

• All document analysis and indexing is performed locally by default
• No document content is sent to external services without explicit user consent
• Indexed data is stored locally and can be encrypted at rest

• Authentication services are logically separated from the local application
• Tokens are signed and validated securely
• No credentials are stored in plaintext
• Secrets and keys must never be committed to the repository

• Do not hardcode secrets, tokens or credentials
• Use environment variables or secure configuration files
• Validate all external inputs
• Apply least privilege principles
• Keep dependencies up to date

If you discover a security vulnerability, do not open a public issue. Contact the maintainers privately with a clear description of the issue and reproduction steps.

Security issues are handled with priority.