Security

Last updated: 2026-07-07

Security Model

OneStone AI's primary security property is local-first architecture. Your data — conversations, memory, knowledge, contacts, calendar, and agent configuration — lives on your local filesystem, not on remote servers. This eliminates an entire class of cloud-based data breach risks.

Credential Storage

API keys and integration credentials are encrypted using your operating system's native keyring:

  • Linux: gnome-keyring via Electron safeStorage
  • Windows: DPAPI (Data Protection API) via Electron safeStorage

Credentials are decrypted only in the running application process and are never written to disk in plaintext. Environment variables passed to agent tool execution are sanitized — secrets are stripped from child process environments.

Tool Execution

OneStone's agent executes tools (file operations, shell commands, web requests) on your local machine. Tool execution includes several safety measures:

  • Path clamping: filesystem tools are restricted to authorized directories.
  • Secret stripping: child process environments are sanitized to prevent credential leakage.
  • Credential injection: saved credentials (GitHub, Cloudflare, Porkbun) are injected per-command only when explicitly requested via useCredentials, never ambient.
  • Shell safety: bash commands pass through a safety gate that validates operations.

Network Communication

OneStone communicates over the network only when:

  • Sending prompts to a configured AI provider (Anthropic, OpenAI, Groq, Mistral, Google)
  • Using AgentMail email integration
  • Using phone pairing via the relay server
  • Checking for updates (to the OneStone releases repository)
  • Agent-initiated web searches or URL reads

All network communication uses TLS. Using Ollama as an AI provider keeps prompts entirely on your machine.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it by email:

[email protected]

Also available at /.well-known/security.txt