Lorvex keeps tasks, calendar events, habits, and memory notes on your own devices and, when iCloud sync is on, in your own iCloud account. A flaw that exposes that data, lets another app or an MCP client act outside what Lorvex allows, or bypasses the prompt-injection fencing on assistant-facing text is a security issue.

Please report security issues privately, not in a public issue. Use GitHub's private vulnerability reporting: open github.com/boyugou/lorvex/security/advisories/new (the Report a vulnerability button on the repository's Security tab).

Include the Lorvex version and platform, the steps that reproduce the problem, and what an attacker could gain. Please allow time for a fix to ship before sharing details publicly.

Security fixes go into the current release. Older builds are not patched.