Privacy and Security

Privacy and Security

What talks to the network

Almost nothing:

• The analysis itself (processes, files, connections) is fully local — no collected data is ever sent anywhere by the script.
• Enrichment calls go to the configured Ollama URL — http://localhost:11434 by default, so local unless you explicitly set a remote --ollama-host.
• The generated HTML loads the 3D rendering library (3d-force-graph) from a public CDN (unpkg.com) when opened — the only outside contact once files are generated. Offline, the page shows an explicit error instead of a blank screen.
• Process text inserted into the HTML (command lines, paths) is escaped to prevent script injection.

Handle your outputs with care

The generated files (HTML/JSON/CSV) contain real data from your machine: usernames, executable paths, IP addresses of active connections. The default .gitignore excludes outputs/ and generated artifacts precisely so they never end up in a commit. Treat exports like logs: don't share them unredacted.

Reporting a vulnerability

Please do not open a public issue for a security problem until it is fixed.

• Preferred: GitHub private vulnerability reporting.
• Alternative: contact the maintainer privately via GitHub (@TFD-42) — no email channel is published for this project.

Full policy: SECURITY.md. Typical scope: unintended code execution via a generated HTML file, privilege escalation via the installers, or a leak of local data beyond what is documented.

Known limitations

• On macOS, listing network connections of processes you don't own requires sudo — otherwise those processes just show 0 connections (not an error).
• A multi-GB Ollama model can be slow to load and answer on CPU-only hardware — default timeouts are calibrated generously for that.
• The 3D graph needs internet at opening time (CDN); PNG and JSON are fully offline.
• The Risk Engine is a triage aid, not an antivirus or EDR — see its page for the honest scope.