Skip to contents

Security Policy

Source: SECURITY.md

Supported versions

Fixes are applied to the most recent release of pakhom.

Reporting a concern

Please report security concerns privately rather than opening a public issue. Email the maintainer at with a description and, where possible, a minimal way to reproduce the problem. You can expect an acknowledgement within a few days.

Handling of API credentials

pakhom calls third-party model providers (OpenAI, Anthropic) and therefore needs an API key. Keys are read from environment variables (for example, via an .Renviron file) and are transmitted only to the configured provider, over HTTPS, to authenticate requests. The key is held in memory for the duration of a run and is never written to logs, the audit trail, cached responses, or any output file. Provider error responses are reduced to the HTTP status plus a masked summary before they can reach the console or the audit trail, so an authentication error that echoes key material back is stripped rather than recorded. Please never commit an API key to version control, paste one into an issue, or include one in a reprex or log you share. Redact any key material before sharing diagnostics.

Data handling and privacy

pakhom runs entirely on your own machine. It contains no telemetry or analytics and sends nothing about you or your data to its author. The package makes network calls to two kinds of destination, both configured by you:

  • The AI provider you choose (OpenAI or Anthropic). The entries you analyze are sent to that provider over HTTPS solely to perform the analysis you requested, and are then subject to that provider’s own data-use policy.
  • Reddit, only when the optional scraper is enabled. scrape_reddit() sends your Reddit credentials to Reddit’s token endpoint and queries the subreddits you listed; the text it retrieves is stored in your local database.

Your input database stays on your machine, along with your configuration and your results.

What a run directory contains

Each analysis writes a run directory that should be treated as research data. The exports, the report and its per-theme pages, the checkpoints used for resuming, and the optional raw-response cache all contain participant text. The per-theme entry exports also carry the contributor identifier (std_author), and the audit trail records every AI decision under a methodology stamp. Review these files as you would any data release before sharing them. Reports generated by versions before 1.1.0 displayed the raw platform text on two report surfaces (the representative quote boxes and the per-theme entry tables); re-render or review such reports before sharing them.

The article What Leaves Your Machine documents every outbound call and every on-disk artifact in detail.