LazarusSecurity
Reporting a vulnerability
Email dev@odysseydevelopments.dev with a description, steps to reproduce and the affected version. Please do not disclose publicly before we have had a chance to fix it.
- We acknowledge reports within 3 business days and aim to give a status update within 10 days.
- We aim to ship fixes for confirmed high-severity issues within 30 days, and credit reporters who want it.
- Good-faith research that avoids other people's data and does not degrade the service is welcome, and we will not take legal action over it.
Only the latest release receives security fixes. See also security.txt.
Scope
In scope: the Lazarus app for Mac, iPhone and iPad, its Keychain handling, local file handling, the pairing and encryption between devices, and the Odyssey relay. Out of scope: flaws in the AI providers' services or command-line tools, in macOS or iOS, or in Monaco itself. Report those upstream.
How it is built
- API keys and GitHub tokens live in the macOS Keychain. Conversations, context and screenshots are stored readable only by you.
- HTTPS to every provider. Hardened Runtime on, and the app is signed with a Developer ID. Updates are checked against a SHA-256 and the same signer before they are installed.
- Pairing a phone is end-to-end encrypted with keys derived from a code that never leaves your devices. Our relay carries sealed messages it cannot read.
- The App Sandbox is off by design, because Lazarus runs git, Xcode builds and agent command-line tools. Each agent has a permission level (read only, edit files, full access) with your own allow and deny rules.
- There is no analytics or crash reporting in the app.
Honest limits
Agents you give full access can change anything your user account can. Odyssey direct messages are stored on the relay and are not end-to-end encrypted. This page describes intent and current design, not a guarantee, and we have not had an independent security audit.
What data leaves your Mac, and where it goes, is in the Privacy Policy.