> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hellofriday.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Friday Studio handles your data, credentials, and vulnerabilities.

Friday Studio runs locally on your machine. Your data — spaces, session history, artifacts, and credentials — stays on your machine and is never sent to Friday's servers.

<Columns cols={2}>
  <Card title="Data stays local" icon="house">
    Everything Friday stores lives in the Friday home directory (default `~/.friday/local/`)  on your machine — spaces, sessions, artifacts, and credentials. Friday does not have access to any of it.
  </Card>

  <Card title="Credential isolation" icon="lock">
    API keys and OAuth tokens are stored locally by the Link service and injected into agent processes at runtime. They are never written into `workspace.yml` or logged.
  </Card>

  <Card title="Localhost only" icon="shield-check">
    All Friday services bind to `127.0.0.1` and are not accessible from other machines on your network.
  </Card>

  <Card title="Webhook tunnel" icon="arrow-right-arrow-left">
    Inbound webhook payloads are forwarded from Cloudflare's edge to your local daemon. Disable entirely with `NO_TUNNEL=true`.
  </Card>

  <Card title="Supply chain security" icon="github">
    Friday's open-code codebase is scanned continuously for dependency vulnerabilities, with automated checks on every code change.
  </Card>
</Columns>

## Reporting a vulnerability

Do not open a public GitHub issue for security problems. Use one of these private channels:

* **GitHub private advisory** — [open a confidential report](https://github.com/friday-platform/friday-studio/security/advisories/new), visible only to maintainers
* **Email** — [security@hellofriday.ai](mailto:security@hellofriday.ai)

Include a description of the issue, affected component, steps to reproduce, and any relevant logs or proof-of-concept. We'll acknowledge within 3 business days and provide an initial assessment within 7. Coordinated disclosure defaults to 90 days from the initial report.

## Supported versions

Security fixes are applied to the `main` branch and shipped in the next release. We do not backport to older releases — run a recent build.

## Contact

For security questions: [security@hellofriday.ai](mailto:security@hellofriday.ai)