Security and privacy

Security and privacy

Threat model

Assistant transcripts can contain secrets, private source code, credentials, customer data, internal URLs, and shell output. Treat the source database, distilled documents, and Cognee volume as sensitive.

Default posture

• Source SQLite opened with mode=ro.
• Local inference endpoint by default.
• Cognee API and UI published on localhost ports.
• .env, progress.json, var/, logs, PID files, and local volumes are gitignored.
• Common API keys, tokens, password assignments, authorization headers, and private-key markers are scrubbed before LLM submission.

Scrubbing limits

Regex scrubbing cannot recognize every organization-specific credential or sensitive business fact. Before operating on regulated data:

1. add patterns for local secret formats;
2. test using synthetic examples;
3. keep inference and storage off public networks;
4. inspect a sample of var/distilled/;
5. apply filesystem permissions and encrypted storage;
6. define retention and deletion procedures.

Network boundaries

docker-compose.yml uses host.docker.internal for Cognee to reach the host inference server. Do not expose the API or UI beyond localhost without:

• authentication;
• explicit CORS origins;
• TLS termination;
• firewall rules;
• secret rotation;
• multi-tenant access control review.

The included default_password is only appropriate for a localhost development stack.

Repository hygiene

Before publishing or sharing diagnostics:

git status --short
git diff --cached
git grep -n -i -E 'api[_-]?key|token|password|/Users/|/home/'

Do not commit .env, source databases, distilled documents, Cognee volumes, raw logs, or extracted credentials.

Deletion semantics

• Delete a test or unwanted dataset with Cognee forget so graph, vectors, metadata, and cache-derived entries are removed together.
• Removing var/distilled/ does not remove already-ingested Cognee knowledge.
• docker compose down -v permanently deletes the local Cognee named volume.
• Source history remains untouched by design; delete it through the source application if required.

Reporting

Open a private security advisory rather than a public issue for vulnerabilities that could disclose transcript data or credentials.