Please do not open a public issue for security problems.

Report privately via GitHub Security Advisories. Include steps to reproduce, impact, and the affected version.

Workbuddian runs entirely on your desktop. It spawns the local WorkBuddy / CodeBuddy CLI via child_process.spawn with your vault as the working directory. It has no server component and sends no telemetry. Relevant areas: CLI path/argument handling, --permission-mode passthrough, files/selection injected into CLI prompts, and reading arbitrary attached files.

The latest release receives fixes. Older versions are not maintained.