# Security Policy

Draft for review by qualified legal counsel. Not final legal advice.

GGSight must protect provider API keys, user authentication tokens, update manifests, and signed release artifacts.

Never expose provider API keys in desktop binaries, JavaScript bundles, installer files, public configuration files, logs, or error messages.

Local-only use must remain available for free MVP users unless product requirements later change.


