Is Locally Uncensored Safe?
The short version: Locally Uncensored is open source under AGPL-3.0, and every release is built by GitHub Actions from the public source. The Windows installer is not code signed yet, so SmartScreen and some antivirus engines warn about it. That warning is a false positive, and this page shows how to check that yourself instead of taking our word for it.
What Is Verifiable Today
| Question | Answer | Where to check |
|---|---|---|
| Is the source public? | Yes, AGPL-3.0 | GitHub repository |
| Who builds the installer? | GitHub Actions, from the master branch | .github/workflows/release.yml |
| Is the Windows installer code signed? | Not yet | SECURITY.md |
| Are updates signed? | Yes, with a minisign key | Public key below |
| Analytics or crash reports? | No analytics kit, no crash reports | README |
| Account required? | No | README |
Why Windows and Antivirus Tools Warn
Three reports have reached us so far. ESET blocks the installer when it runs. Avast shows the heuristic Win32:NSIS_Error[Heur]. Microsoft SmartScreen shows an "unrecognized app" warning on first run. All three are heuristics, and they have three causes.
- The installer is not Authenticode signed yet. Without a Microsoft code signing certificate, every reputation based check starts at zero trust.
- The app downloads other programs on first run. Locally Uncensored is a small Tauri app packaged with NSIS. On first run it fetches Ollama, ComfyUI, Python and model files. Behavioural scanners know that pattern from droppers. Here every download path is in the public source, in
src-tauri/src/commands/install.rsandsrc-tauri/src/commands/ollama.rs. - NSIS is an installer format that scanners flag often, because some malware families have used it in the past.
How to Verify the Download Yourself
- Check the source. Download only from the official GitHub Releases page. Every release there is built by GitHub Actions from public source.
- Check the SHA-256. GitHub Releases lists the exact bytes that were uploaded. Scan the file on VirusTotal and compare the hash it shows with the one on the release.
- Read an independent check. A community member followed up on the Avast alert with an OPSWAT deep scan and reported the result as clean. The full write up is in Discussion #25.
- Build it yourself. Clone the repository and run
npm ci && npm run tauri build. You end up with an installer from the same source, built on your own machine.
Updates Are Signed
The update channel is already signed. Under Settings, then Updates, the app reads latest.json from GitHub Releases and validates the bundle signature against this minisign public key:
RWRHseb4LudtbIpBRaMDxMpSLMq+1TqeULJS/HY2/eviNqnAXVVyGsDcIf a tampered update were ever served, the signature check would fail and the app would reject it. That leaves the first install as the one weak link, and it is the one the code signing work is meant to close.
What the App Sends Over the Network
In local mode, chat, agent runs, and image and video generation all happen on your machine. After the model download they work without a connection. You do not need an account. The app has no analytics kit and sends no crash reports.
On its own the app uses the network for two things. It checks GitHub Releases for updates shortly after start and at most every six hours after that. It also counts each press of the Cloud switch: which way, platform and app version, with no identifier. While you are signed in to LU Cloud it checks your account every five minutes. The full list is in the app under Settings, General, Privacy.
Code Signing Status
A signed installer is the long term fix. Free code signing is provided by SignPath.io, with a certificate by SignPath Foundation. SignPath Foundation has accepted the project. The production certificate is not in place yet, and until it is the Windows installers ship unsigned. The current state is always in SECURITY.md.
Reporting a Security Issue
Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting or send a direct message on Discord. Reports are acknowledged within 48 hours and assessed within one week. For critical issues the aim is a patch within two weeks.
If your antivirus flags the installer, you can also submit it to the vendor as a false positive. SECURITY.md lists the submission forms for ESET, Microsoft Defender, Avast and AVG, Bitdefender, Kaspersky, Norton and McAfee.
FAQ
Is Locally Uncensored a virus?
No. It is an open source desktop app under AGPL-3.0, built by GitHub Actions from public source. Some antivirus engines flag the unsigned Windows installer through heuristics, which is a false positive. You can check the SHA-256 from GitHub Releases on VirusTotal yourself.
Why does Windows SmartScreen block the installer?
The Windows installer is not Authenticode signed yet. Without a code signing certificate SmartScreen has no reputation data and shows an "unrecognized app" warning on first run.
Is Locally Uncensored legit?
Yes. The full source is public on GitHub under AGPL-3.0, releases are built in public by GitHub Actions, and anyone can build the same installer from source with npm ci && npm run tauri build.
Does Locally Uncensored collect my data?
Local mode needs no account. Chat, agent runs, and image and video generation happen on your machine. The app has no analytics kit and sends no crash reports. It checks GitHub Releases for updates and counts each press of the Cloud switch without an identifier.
Where is the safe place to download it?
The official GitHub Releases page. Every release there is built by GitHub Actions from the public master branch.
Will the installer be signed?
That is the plan. SignPath Foundation has accepted the project for free code signing. The production certificate is not in place yet. Updates are already signed with a minisign key.