Security Policy

Loophole is designed with security as a foundational property. Because Loophole has no backend server, there is no central infrastructure to compromise and no single point of failure that could expose all users' data simultaneously. All AI requests are made directly from your machine to the AI provider's API over HTTPS. API keys are stored in the operating system's native secure credential storage — never in plaintext config files. The agentic engine's tool calls (file edits, terminal commands, MCP tool invocations) each have independent approval controls, giving you fine-grained oversight over what the agent is permitted to do without manual confirmation.

Security updates are provided exclusively for the latest stable release of Loophole. We strongly recommend always running the most recent version. Older versions may contain known vulnerabilities that will not receive backported patches. Check the releases page for the current stable version.

Do not report security vulnerabilities through public GitHub issues. Public disclosure before a fix is available puts all Loophole users at risk. Please use the private reporting process below.

1. Email hi@loopholeeditor.in with the subject line "Security Vulnerability Report"
2. Describe the vulnerability in detail — what it is, what it affects, and its potential impact
3. Include steps to reproduce the issue, or a proof-of-concept if available
4. Include your preferred contact method and whether you would like to be credited in the security advisory
5. Wait for our acknowledgment before making any public disclosure

We aim to acknowledge all vulnerability reports within 48 hours and to provide an initial assessment within 7 days.

We follow a coordinated disclosure model. When you report a vulnerability privately, we commit to:

1. Acknowledging your report within 48 hours
2. Investigating and validating the reported issue with you
3. Developing and testing a fix, keeping you informed of progress
4. Releasing a patched version and publishing a security advisory
5. Crediting you by name or handle in the advisory, if you wish

We appreciate the security research community's work in keeping open-source software safe. We ask that you give us reasonable time to address the issue before any public disclosure.

Follow these practices to use Loophole safely:

Loophole sends AI requests directly from your machine to your chosen provider's API over HTTPS. No data passes through Loophole servers or any intermediate relay. However, the security of data in transit and at rest at the provider is subject to the provider's own security practices. Review the security documentation of Anthropic, OpenAI, Google, DeepSeek, or any other provider you use — especially for sensitive or regulated codebases. Many enterprise-tier AI providers offer data processing agreements (DPAs), zero retention policies, and SOC 2 compliance.

The complete Loophole source code is publicly available at github.com/loophole-ai/loophole-ide. Security teams, enterprise procurement reviewers, and individual users can audit every network call, every credential handling path, and every agentic tool implementation directly in the source. We believe open-source auditability is the highest standard of security transparency available. If you find something in the code that contradicts our security claims, please report it via the vulnerability disclosure process above.

For private vulnerability reports: hi@loopholeeditor.in
For general security questions: GitHub Discussions
For non-security issues: GitHub Issues