# Security Policy

## Design Philosophy

Fulloch is designed with privacy as a core principle. All processing happens locally on your device:

- **Speech Recognition**: Qwen3 ASR runs entirely on-device (or Moonshine Tiny for edge devices)
- **Text-to-Speech**: Qwen3 TTS with voice cloning runs entirely on-device (or Kokoro for edge devices)
- **Language Model**: Qwen 3 4B runs entirely on-device via llama.cpp
- **No Cloud Dependencies**: No data is sent to external servers for AI processing

## Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

1. **Do NOT** open a public GitHub issue for security vulnerabilities
2. Email the maintainers directly with details of the vulnerability
3. Include steps to reproduce if possible
4. Allow reasonable time for a fix before public disclosure

## Security Considerations

### Configuration Files

- `data/config.yml` contains service credentials and should never be committed
- `.env` files contain sensitive environment variables
- Both files are excluded from git via `.gitignore`

### Network Services

Fulloch connects to external services for smart home control:

| Service | Connection Type | Data Sent |
|---------|----------------|-----------|
| Spotify | HTTPS API | Playback commands |
| Philips Hue | Local HTTP | Light commands |
| Google Calendar | HTTPS API | Calendar queries |
| SearXNG | Local HTTP | Search queries |
| LG ThinQ | HTTPS API | Appliance queries |
| WebOS TV | Local WebSocket | TV commands |
| Pioneer AVR | Local TCP | Audio commands |
| Airtouch | Local Discovery | HVAC commands |

### Best Practices

1. **Network Isolation**: Run Fulloch on a trusted local network
2. **Credential Rotation**: Regularly rotate API keys and tokens
3. **Minimal Permissions**: Use read-only API access where possible
4. **Update Dependencies**: Keep dependencies updated for security patches

### OAuth Tokens

- Google Calendar tokens are stored in `data/token.json`
- Spotify tokens are managed by the spotipy library
- Tokens should be treated as secrets and not shared

## Supported Versions

| Version | Supported |
|---------|-----------|
| Latest  | Yes       |
| Older   | No        |

Only the latest version receives security updates.