Security

Security Model

OneStone AI's primary security property is local-first architecture. With the desktop app, your data — conversations, memory, knowledge, contacts, calendar, and agent configuration — lives on your local filesystem, not on remote servers, which removes an entire class of cloud data-breach risk. The optional web dashboard keeps each account's data in its own isolated storage space, encrypts saved credentials (AES-256-GCM, with a per-account key that is itself encrypted), and signs you in with GitHub or a passkey — there are no passwords to leak.

Credential Storage

In the desktop app, API keys and integration credentials are encrypted using your operating system's native keyring:

• Linux: gnome-keyring or KWallet via Electron safeStorage — with no keyring present, keys are stored unencrypted and the Connections page shows a warning
• Windows: DPAPI (Data Protection API) via Electron safeStorage

Credentials are decrypted only in the running application process. Environment variables passed to agent tool execution are sanitized — secrets are stripped from child process environments.

Tool Execution

OneStone's agent executes tools (file operations, shell commands, web requests) on your local machine. Tool execution includes several safety measures:

• Write limits: the file-writing tools write only inside the active project's folder, the system temp folder or OneStone's scratch folder. Reading files and shell commands are not confined by path.
• Secret stripping: child process environments are sanitized to prevent credential leakage.
• Credential injection: saved credentials (GitHub, Cloudflare, Porkbun, and the OpenRouter, Groq, Mistral and Gemini keys) are injected per-command only when explicitly requested via useCredentials, never ambient.
• Shell safety: bash refuses work a purpose-built tool does, and an optional setting (off by default, Settings → Tools) blocks dangerous commands or asks your approval for them or for every command.

Network Communication

The desktop app communicates over the network only when:

• Sending prompts to a configured AI provider (Anthropic, OpenAI, Google Gemini, Groq, Mistral, OpenRouter, Ollama), or to Claude through the Claude CLI
• Using AgentMail email integration
• Using phone pairing via the relay server
• Syncing with the web dashboard, after you link it
• Checking for updates (to the OneStone releases repository)
• Agent-initiated web searches (DuckDuckGo) or page reads
• Using a service you connected — GitHub, Cloudflare, Porkbun or an external MCP server

Connections to remote services use TLS. Prompts to local models go only to the Ollama server you set (on this machine by default). Phone access always goes through the relay.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it by email: mantione.joe@agentmail.to.

Also available at /.well-known/security.txt