We recommend always running the latest version of AIX CLI.

We take security seriously. If you discover a vulnerability, please report it responsibly — do not open a public GitHub issue.

1. Preferred: Use GitHub Security Advisories to report privately.
2. Alternative: Email the maintainer at [email protected] with the subject line [SECURITY] AIX CLI vulnerability report.

• Description of the vulnerability and its potential impact
• Steps to reproduce — clear, minimal instructions
• Affected versions — which versions of AIX CLI are impacted
• Source file paths related to the issue, if known
• Proof of concept or exploit code, if available
• Suggested fix, if you have one

We will keep you informed throughout the process and credit you in the release notes (unless you prefer to remain anonymous).

The following are considered in-scope vulnerabilities:

• Remote code execution — arbitrary code execution via crafted input
• Command injection — unsanitized input passed to shell commands
• Path traversal — accessing files outside expected directories
• Data exposure — sensitive data leaked through logs, errors, or config
• Denial of service — inputs that crash or hang the CLI
• Dependency vulnerabilities — known CVEs in direct dependencies

• Vulnerabilities in LM Studio, Claude Code, or Ollama themselves (report to their respective maintainers)
• Issues requiring physical access to the machine
• Social engineering attacks

AIX CLI is designed with a minimal attack surface:

• Local-only operation — no outbound network calls except to localhost
• No telemetry — no data collection, tracking, or analytics
• No credentials stored — AIX does not handle API keys or tokens
• Minimal permissions — no elevated privileges required
• Open source — the entire codebase is available for audit

• Keep AIX CLI and LM Studio updated to the latest versions
• Download AI models only from trusted sources
• Review model metadata and permissions before loading
• Run AIX CLI in a user-space environment (avoid running as root)
• Keep your operating system and Node.js up to date