Security and Safety¶
Boundary¶
The strongest privacy property is architectural: prompts, audio, model inference, tool execution, and generated speech are intended to remain in the browser. Model weights are fetched from external CDNs, but application conversation data is not sent to an application API.
Controls¶
- Microphone access is explicit through
getUserMedia. - The UI checks secure-context status and reports WebGPU/browser capability.
- Tool names and arguments pass through validation and a registry before execution.
- Tool rounds and per-round calls are bounded.
- Image input is resized before it is attached to a request.
- Abort and cleanup paths stop audio tracks, workers, model streams, and object URLs.
- Experimental tools are opt-in through preferences.
Risks¶
- A compromised dependency or model asset would execute within the browser’s origin capabilities.
- Browser permissions and cross-origin isolation need to be configured correctly by the host.
- Local tools are safe only while the registry remains narrow and validated.
- Model prompt injection can still influence tool selection; tool validation is not a complete policy engine.
- Logs may contain prompts, responses, or timing data in the browser console.
Hardening opportunities¶
Use a strict content-security policy, pin and audit model/dependency sources, make tool permissions explicit per tool, reduce sensitive console logging in production, and add browser-level tests for permission denial and worker failure.
Privacy data-flow review¶
| Data | Leaves browser? | Notes |
|---|---|---|
| Microphone PCM | No application server | Sent to local STT worker |
| Prompt/history | No application server | Passed to local selected LLM |
| Uploaded image | No application server | Resized and passed to vision-capable local model |
| Model weights | Yes, CDN download | External asset fetch; then cached locally |
| Tool calls | No application server | Built-in local registry |
| Generated audio | No application server | In-memory PCM/object URL |
The privacy claim is therefore “no application data leaves the device,” not “the browser makes no network requests.” CDN model downloads and third-party dependency fetches remain part of the supply-chain boundary.
Browser security assumptions¶
The app needs a secure context for microphone access and relies on same-origin worker assets. The lack of a backend removes server-side secret exposure, but browser XSS, malicious extensions, compromised dependencies, and model files still matter. Production should apply CSP, avoid unsafe HTML rendering, and review markdown/image handling.