Kalamu is in early development: only the latest tagged release receives fixes. Installers are published per tag on the releases page.
Report privately through GitHub's private vulnerability reporting rather than opening a public issue. Expect an acknowledgement within a week.
Dependabot security alerts are on, and cargo audit and cargo deny run in CI; a security
alert takes priority over feature work.
- Provider API keys (Gemini, OpenAI, Anthropic, Mistral) are stored in the system's keychain
(Windows Credential Manager, the macOS Keychain) and read only by the Rust core, into the one request that needs them. They are never
written to the front end's storage, the settings, the job database,
provenance.jsonor the logs. - The interface runs under a restrictive content security policy (
connect-src 'self'): every call to a provider is made by the Rust core, not the web view. The only frame allowed is YouTube's privacy-enhanced player, loaded when the user plays a video.
Files the user adds to a job go directly to the provider the user chose, under that provider's terms; offline Whisper keeps recordings on the PC. User-requested Whisper downloads come from Hugging Face and are checked against their size and SHA-256 before use. The app also fetches the public model catalogue from this repository, and video titles from YouTube's oEmbed service. The developer receives no files, results or keys. See the privacy policy.
The installers on GitHub Releases are unsigned, so Windows SmartScreen may warn on first
launch ("Windows protected your PC": choose More info, then Run anyway). Download them
only from the releases page linked above. From version 1.0.0 Kalamu is also in the
Microsoft Store, whose copy is signed by
Microsoft and updated automatically (docs/microsoft-store.md). The .msix and .msixbundle files on a
release are the unsigned Store submission, for testing; they do not install as they are.
The macOS disk image is signed ad hoc, not with an Apple Developer ID, and not notarised, so macOS refuses to open it the first time: choose Open Anyway in System Settings → Privacy & Security (README, "On a Mac"). Download it only from the releases page. Signing and notarisation are planned (docs/decisions/2026-11-02-macos.md).