security

Security

Lode's main security boundary is local repository source. The project is designed to keep indexed facts on local disk and avoid hosted telemetry or external code-search services by default.

Trust boundaries

Boundary	Source path	Notes
Local repository input	src/lode/indexer.py	Parses untrusted source files from a selected repo path.
SQLite data directory	src/lode/storage.py, src/lode/config.py	Stores source-derived metadata and snippets locally.
Local HTTP daemon	src/lode/daemon.py	Binds to localhost by default.
Embedding service	src/lode/embeddings.py, docker-compose.yml	Optional local HTTP call to a configured embedding URL.
Logs	src/lode/observability.py	Redacts sensitive field names before structured logging.

Logging redaction

sanitize() in src/lode/observability.py redacts keys containing password, secret, token, key, or authorization. New log events should use log_event() so the same redaction path applies.

Dependency and code scanning

CI runs Bandit and pip-audit in .github/workflows/ci.yml, while CodeQL runs through .github/workflows/codeql.yml. Dependency update automation is configured in .github/dependabot.yml and renovate.json.

Safe extension points

• Keep daemon binds local unless the user explicitly chooses otherwise.
• Treat repository contents as sensitive when adding new outputs or logs.
• Prefer .env.example for documented environment variables and never commit local .env files.

Related pages

• Observability
• Configuration
• Deployment