Report it privately by opening a security advisory in this repository, or email security@tolvilabs.com with details and reproduction steps. Do not open a public issue for security reports. We aim to acknowledge within 72 hours.

Forge runs entirely on the user's machine and makes no outbound network calls during execution beyond the local Ollama service. Report any behavior that contradicts this local-first guarantee.