Security
The short version: Locally Uncensored is an open source desktop app (AGPL-3.0) that runs models on your own computer. In local mode your chats and generations stay there. Every release is built in public by GitHub Actions and has to pass the same automated checks first. There has not been an independent security audit yet. One is planned, and this page says what is checked until then.
What runs on your machine
In local mode the models run on your own hardware, through the built-in engine, Ollama, LM Studio or ComfyUI. Chats, memories, documents and the images, clips and audio you generate are saved in the app's folders inside your user profile. Local mode needs no account. The app has no analytics kit and no advertising ID, and it does not upload crash reports: a crash is written to crash.log on your computer and stays there unless you attach it to a support request yourself.
What leaves your machine, and where to
| When | What is sent | To |
|---|---|---|
| Always, on its own | Update check a few seconds after start and every six hours | GitHub Releases |
| When you press the Cloud switch | One anonymous count: what the press did, the operating system as one word, the app version | LU Labs |
| Finding or downloading a model | The search or the file you fetch | Hugging Face, Civitai or ollama.com |
| Installing an engine | The packages it needs | GitHub, python.org, pytorch.org, PyPI |
| Web search in a chat or the agent | The search words; pages are fetched from your machine | Your own SearXNG, otherwise DuckDuckGo (Wikipedia as fallback), or Brave or Tavily with your key |
| A provider you add with your own key | Your prompts, under your key | That provider (for example OpenAI or OpenRouter) |
| Remote access over the internet | The traffic between your phone and your PC | Through a Cloudflare tunnel |
| LU Cloud mode | Chats, Create renders and voice requests | lu-labs.ai, processed on managed GPUs |
The full list, with what each request contains, is on the privacy page and in the app under Settings, General, Privacy.
What is off until you turn it on
- Remote access. Off until you start it. A phone needs the QR code and a six-digit passcode, and the four permission switches start off. In home network mode the traffic stays in your network; internet mode goes through a Cloudflare tunnel whose address is new for every session. Details on the remote access page.
- Computer control. Off by default. The first time a chat wants the screen, a card asks whether it may be used there, and until you click nothing is captured. Apps such as terminals, password managers and system sign-in dialogs are off limits.
- The local API. Runs only when you start it in Settings and asks for a token. It answers on your own machine, and on your home network only if you allow that.
- LU Cloud. Needs an account and a deliberate switch from Local to Cloud.
What every release has to pass
Each push to master and every release runs the same gate, defined in ci.yml. A release is built only after it is green.
- Lint, type check, the unit test suite and end-to-end tests of the interface
- Rust tests on Linux, Windows and macOS, Clippy, and a full app build for each platform
- A dependency audit:
npm auditfor the packages the app ships,cargo denyandcargo auditfor the Rust crates. An advisory we accept is listed with its reason indeny.toml. - CodeQL static analysis of the TypeScript, Rust, Python and workflow code, with results in the repository's Security tab
- Every third-party GitHub Action pinned to a full commit hash, so a retagged upstream release cannot run in the build
The OpenSSF Scorecard rates how the repository itself is run, and the result is public, gaps included.
Signatures and checksums
- Updates are signed. The app accepts an update only if its minisign signature matches this public key:
RWRHseb4LudtbIpBRaMDxMpSLMq+1TqeULJS/HY2/eviNqnAXVVyGsDc - Mac: the app is signed with an Apple Developer ID and notarized by Apple.
- Windows: the installer is not Authenticode signed yet. SignPath Foundation has accepted the project for free code signing; the production certificate is applied for and not in place yet. Until then SmartScreen and some antivirus engines warn, see Is it safe?
- Checksums and SBOM: from 3.0.8 on, every release carries a
SHA256SUMS.txtover all its files and a software bill of materials in CycloneDX format for the npm packages, the Rust crates and the Python packages of the voice feature.
To check a download on Linux or macOS, put SHA256SUMS.txt next to it and run sha256sum -c SHA256SUMS.txt --ignore-missing (on a Mac shasum -a 256 -c). On Windows, Get-FileHash in PowerShell prints the hash to compare.
Independent audit
No outside firm has audited Locally Uncensored so far. We are looking for funding for one that covers the desktop app (Tauri, Rust and React), its bridges to the local engines, the local API and remote access. When a report exists it will be linked here and in SECURITY.md, findings included.
Reporting a security problem
Please do not open a public issue. Use GitHub's private vulnerability reporting or email hello@lu-labs.ai with "Security" in the subject. Reports are acknowledged within 48 hours and assessed within seven days; a critical or high issue is fixed within 14 days of accepting it. What is in scope is listed in SECURITY.md.
FAQ
Has Locally Uncensored been independently audited?
Not yet. No outside firm has reviewed the code so far. An independent audit is planned and the report will be linked from this page and from SECURITY.md once it exists. Until then the checks listed on this page are the ones that run, and the source is public for anyone to review.
Does Locally Uncensored send my chats anywhere?
Not in local mode. Chats, agent runs, documents and generated images, clips and audio stay in the app's folders on your computer. They leave it only when you choose a route that needs it: LU Cloud, a provider you add with your own key, web search, or remote access to your own PC.
How do I check that a download is genuine?
Download only from the GitHub Releases page. From 3.0.8 on every release has a SHA256SUMS.txt; compare the installer's SHA-256 with it. Updates are checked against a minisign signature by the app itself, and the Mac app is signed and notarized by Apple.
How do I report a security problem?
Use GitHub's private vulnerability reporting for the repository, or email hello@lu-labs.ai with Security in the subject. Please do not open a public issue. Reports are acknowledged within 48 hours.