Security fixes are applied to the latest release on main / npm.

tkntracker is a local CLI that:

• Reads existing agent log files and local SQLite / VS Code state databases
• Stores token counts, model names, timestamps, and provider metadata only
• Serves a dashboard on localhost

It is designed not to store prompts, responses, source code, or API keys.

Please do not open a public GitHub issue for security problems.

Prefer one of these private channels:

1. GitHub Security Advisories on this repository
   → Report a vulnerability
   (available once the repo exists and Security Advisories are enabled)
2. Contact the maintainer privately via their GitHub profile

Include:

• Description of the issue and impact
• Steps to reproduce
• Affected version / commit
• Suggested fix (optional)

You should receive an acknowledgement within 7 days. We will work with you on a coordinated disclosure when appropriate.

In scope

• Path traversal or arbitrary file read beyond intended tool data roots
• Local HTTP server issues that could expose data beyond localhost assumptions
• Dependency vulnerabilities in published packages
• Accidental persistence of prompts, secrets, or credentials

Out of scope

• Issues that require an attacker to already have full access to the user’s machine
• Social engineering, phishing, or physical access
• Vulnerabilities in third-party coding agents themselves (report those upstream)
• Denial of service against your own local process

• Keep Node.js and tkntracker updated
• Do not expose the dashboard port to the public internet
• Treat ~/.tkntracker/data.db as private usage metadata (not as sensitive as prompts, but still personal)
• Uninstall by removing the global package and deleting ~/.tkntracker/ if you want a clean wipe

Thank you for helping keep users safe.