Longhand's threat model, trust boundaries, and hardening live in SECURITY.md in the main repo. That's the canonical document — this page is a summary and a pointer.

• Local-only. Nothing you stored ever leaves your machine. Network activity is limited to the one-time embedding-model download, an optional once-daily version check against pypi.org (interactive CLI only — never hooks or the MCP server, test-enforced; LONGHAND_NO_UPDATE_CHECK=1 disables it), and commands you explicitly run.
• No shell, ever. The only subprocesses are fixed, list-form argv (launchctl, detached python -m longhand … workers) — nothing derived from JSONL content is ever executed.
• Parameterized SQL everywhere. No string concatenation in queries. Every filter goes through bind parameters.
• Read-only on source files. ~/.claude/projects/ is never written to.
• Fail-open hooks. A Longhand crash doesn't block Claude Code.

• Command injection
• SQL injection
• Path traversal
• OOM via oversized input

• Filesystem read access for a user who already controls the machine
• Malicious MCP client
• Secrets in prompts that get written to JSONL

Full audit notes, trust boundary diagrams, and parameterized-SQL guarantees are in SECURITY.md. If you find something, open an issue or contact the maintainer directly.