Mightling runs an agent with a shell on your machine, close to your code and, if you connect them, your mail, files and calendar. Reports about anything that weakens that are welcome.

Please report privately, through GitHub: the repository's Security tab → Report a vulnerability. If you cannot use GitHub, email [email protected] instead. Do not open a public issue for a vulnerability.

Include what you ran, what you expected and what happened, and the output of ling --version and ling-admin status. You will get an answer within a week.

Disclosure is coordinated, with a window of 90 days from your report. Please keep the details private until a fixed release is out or the 90 days have passed, whichever comes first; if a fix needs longer, we will say why and agree a later date with you.

• The air gap. Any way for a command in a session at /airgapped on to reach a network other than the model server, or to lower the level without you typing /airgapped off.
• Phone-home channels. Any network connection ling makes that the privacy page does not list. ling-admin audit egress traces one session and is a good way to show one.
• The sandbox. A sandboxed command writing outside the folders it was given, or starting outside the sandbox without an approval.
• Untrusted input. Email, Drive or Calendar content, a web page, a skill or a repository that gets the agent to act without your approval in a way the sandbox should have stopped.
• Node pairing and jobs. Anything a paired node can make another node do beyond the operations ling-admin node serve-job lists.
• Host safety. A model load that freezes the host despite ling-admin server start's checks.

• The model server listens on every interface, without a key (port 8000), because the web chat and other agents reach it from Docker containers. Mightling assumes a trusted local network; see Privacy & security for how to restrict it.
• The web chat's default administrator password is published. It is bound to 127.0.0.1 unless you advertise the machine as a node; create the account with your own password.
• Full Access has no sandbox. That is what it means, and why it cannot be combined with /airgapped on.