Lucky is a local-first desktop agent harness. Users configure their own model providers, API keys, workspace folders, MCP servers, and optional Docker sandbox. Treat that trust boundary carefully.
Lucky is under active pre-release development. Security fixes are applied on the default branch (main). There is not yet a long-term support (LTS) release train.
By design, durable user data lives under the current Windows user profile, not in this repository:
| Data | Location (typical) | Protection |
|---|---|---|
| Settings, projects, chats, memories | %LOCALAPPDATA%\Lucky\lucky-state.json |
API keys and MCP launch config via Windows DPAPI (current user) |
| ChatGPT subscription helper state | %LOCALAPPDATA%\Lucky\ helper home |
OAuth material as DPAPI-protected blob when at rest |
The repository must never contain live API keys, OAuth tokens, chat transcripts, or personal workspace state.
Do not open a public GitHub issue for security vulnerabilities.
Please report privately using one of:
- GitHub private vulnerability reporting for this repository (preferred when enabled), or
- Email the maintainer via the address on the GitHub profile if private reporting is unavailable.
Include:
- A clear description of the issue and impact
- Steps to reproduce, or a minimal proof of concept
- Affected commit or release, if known
- Whether you plan to disclose publicly and on what timeline
You should receive an acknowledgment when practical. Please give a reasonable window to investigate and ship a fix before public disclosure.
- Issues that require the user to deliberately enable
FullAccess, install a malicious MCP server, or run untrusted PowerShell on their own machine, unless Lucky misrepresents those risks or fails to honor documented access-level gates - Vulnerabilities only present in third-party model providers, SearXNG instances, Docker, or MCP servers Lucky does not ship
- Social engineering of API keys outside Lucky's storage/protection path
- Never commit secrets,
.envfiles, personaldocs/private/notes, or reallucky-state.jsondumps - Do not log or display raw API keys, OAuth tokens, or MCP launch secrets
- Prefer loopback defaults for local tools; require explicit user configuration for remote endpoints
- Keep access-level gates enforced in code, not only in prompts
- When adding network, filesystem, shell, MCP, or sandbox capabilities, document limits in
README.md/docs/ARCHITECTURE.mdand add tests where feasible