Please do not open a public GitHub issue for security problems.

Report privately to the maintainer at security@loopy.yachts (or open a GitHub private security advisory). Include:

• A description of the issue and its impact
• Steps to reproduce
• Affected version / commit
• Any suggested remediation

We aim to acknowledge reports within 3 business days.

Loopy is local-first. It runs on your machine with your own API keys:

• Secrets and settings live in ~/.loopy/config.json — never in the repo and never uploaded to a hosted Loopy service.
• Builds execute in a local working directory; code is pushed only to the GitHub repo you connect.
• Third-party calls go directly from your machine to the providers you configure (Composio, Nebius, Tavily, Firecrawl, your coding-agent CLI, etc.).

Loopy runs real coding agents that modify repos and call external tools. Guardrails:

• Policy checks — agents declare denied_paths, allowed_repos, risk tiers, and approval requirements; violations gate progress (force review instead of auto-ship).
• Branch safety — when Loopy attaches to an existing repo it ships via a loopy/* branch + PR rather than force-pushing main.
• Human-in-the-loop — a preflight gate pauses for missing integrations or clarifying questions, and email/Linear replies steer an active run.

If you find a way these guardrails can be bypassed, report it as above.

Loopy is pre-1.0 and ships from main. Security fixes land on main; update with loopy update.