Gaal reads local AI agent session logs and can index sensitive local context, including prompts, commands, file paths, and transcript fragments. Treat Gaal databases, exported reports, handoffs, and package fixtures as potentially sensitive unless you have reviewed them.

Please report suspected security issues privately through GitHub Security Advisories for buildoak/gaal, or email buildoak@proton.me if advisories are not available.

Do not include private session logs or secrets in public issues. Share the minimal reproduction, affected version, platform, and impact. Reports are handled on a best-effort basis.