generated: '2026-08-27'
method: searched
source: https://github.com/mudler/LocalAI/blob/master/SECURITY.md
policy_url: https://github.com/mudler/LocalAI/blob/master/SECURITY.md
policy_http_status: 200
published: true
security_txt: false
security_txt_note: >-
  No /.well-known/security.txt is served on localai.io or agenthub.localai.io (both 404, probed
  2026-08-27). The policy is published as a repository SECURITY.md instead, which GitHub surfaces on the
  repository's Security tab but which no automated /.well-known probe will find.
contact:
  email: security@localai.io
  method: email
  disclosure_type: coordinated
process:
- step: 1
  action: >-
    Email security@localai.io with a detailed report. Do not disclose publicly or to third parties before
    the issue has been addressed.
- step: 2
  action: Acknowledgement of receipt is targeted within 48 hours.
- step: 3
  action: >-
    If accepted, the maintainers work with the reporter and the community to address the issue, keeping
    the reporter informed and possibly requesting further collaboration.
- step: 4
  action: Coordinated disclosure once resolved.
response_target: 48 hours to acknowledge
bug_bounty:
  monetary: false
  note: >-
    Stated explicitly: as a FOSS project LocalAI offers no monetary bounties. Researchers who want
    recognition are pointed at Huntr.
  platforms:
  - name: Huntr
    url: https://huntr.dev/bounties
    type: recognition-only
safe_harbor:
  stated: false
supported_versions:
  url: https://github.com/mudler/LocalAI/blob/master/SECURITY.md
  stale: true
  note: >-
    The policy's supported-versions table names 3.x as actively supported and does not mention the 4.x
    series that has been shipping since before v4.5.6 (2026-06-30). Both dated windows in the table
    (2.x security fixes until 2025-12-31, 1.x EOL since 2024-01-01) are already in the past. A reporter
    reading the policy today cannot tell whether the release they are running is in support. See
    lifecycle/localai-lifecycle.yml.
product_security_features:
  note: >-
    Not disclosure, but the security posture a deployment can adopt — recorded because for self-hosted
    software these are the controls that substitute for a vendor's security program.
  features:
  - id: deny-by-default-auth
    since: v4.9.0
    description: Every HTTP route requires credentials unless it appears on the published anonymous list.
  - id: opaque-errors
    env: LOCALAI_OPAQUE_ERRORS
    description: Error responses return an empty body with only a status code, preventing information leaks.
  - id: pii-redaction
    description: >-
      NER-based request-side PII redaction and blocking, on by default for any cloud-proxy backend because
      that traffic crosses the network to a third-party provider.
    docs: https://localai.io/features/middleware/
  - id: oidc-sso
    description: Generic OIDC single sign-on with role-based access control and per-user API keys.
  - id: mcp-read-only
    description: '`local-ai mcp-server --read-only` skips registration of every mutating admin tool.'
  - id: signed-backends
    description: >-
      Backend OCI images are signed with keyless cosign and verified with sigstore-go. A gallery entry
      carries a `verification:` block; LOCALAI_REQUIRE_BACKEND_INTEGRITY enables strict mode, and
      revocation is expressed through a `not_before` timestamp. Producer-side signing runs in CI.
    verified: true
    source: https://github.com/mudler/LocalAI/blob/master/.agents/backend-signing.md