What leaves your Mac and security
Check which requests leave your Mac, where credentials stay, and what the app permits research tools to do.
Local records and remote requests#
| Destination | What it receives |
|---|---|
| This Mac | Chats, Sources, Map, Lens, Journal, holdings and research files |
| Your AI provider | Messages and the Sources and saved notes used by answers or background reading |
| Data sources | Requested names and tickers; public wallet addresses you add |
| Web services | Searches and pages opened for research |
| A custom connection | The requests its permitted tools make |
Holdings quantities and values stay local in app-managed research context. Information you type into a message still goes to the selected AI provider. Private chat skips Memory reads and saves; it still saves chat history and sends messages to the provider.
There is no Loupist account, cloud sync, analytics or telemetry. The app contacts GitHub to check a signed update feed about once a day, sooner after failed checks.
Credentials#
Data connection secrets use the macOS Keychain. AI sign-ins and keys stay in private app storage on this Mac. Enter credentials only in the dedicated setup form. The app does not return them to the model or show them again in connection fields.
This is not protection from every same-user process on your Mac: other software running as you can still pose a risk to local data. Keep credentials and private research out of public bug reports.
Files, code and outside text#
Native file tools are limited to admitted workspace, scratch, attachments and bounded instruction locations. Credentials, private app data and Git metadata are refused. Bundled Skills are read-only. Files written inside an allowed folder can survive cancellation.
run_python has no shell, network or host environment. Its offline snapshot and output writes are bounded. A sandbox reduces access; it does not establish that every generated file is safe to run in another program.
Outside text can carry hidden instructions. After reading it, selected schedule, connection and instruction-file actions pause for the reply. A custom-connection result adds a broader outbound pause. The app explains the refused step; ask for a paused action in a later message.
Report a vulnerability#
Use GitHub private vulnerability reporting. Include the affected version, a minimal reproduction with fictional data and the observed impact. Do not put credentials or private research in public issues.
Based on the app’s source documentation and English interface labels. Report a docs issue.