DeskWeave can relay local AI approvals and therefore sits on a sensitive trust boundary.

The project is currently pre-alpha. Security fixes are applied only to the latest revision on main until the first stable release.

Do not open a public issue for vulnerabilities involving authentication, approval bypass, credential exposure, path traversal, unsafe file access, or remote code execution. Use GitHub's private vulnerability reporting feature under the repository Security tab.

Include the affected revision, operating system, reproduction steps, impact, and any suggested mitigation. Please avoid including real Feishu, OpenAI, Anthropic, or user credentials.

• Keep the Remote backend on loopback.
• Allowlist both the user and conversation.
• Treat mobile approval access as equivalent to local approval access.
• Store production secrets outside tracked configuration files.
• Review and sign Windows artifacts before unattended deployment.