Persistent Sage

Threat model · Honest limits

Security overview

Persistent Sage is local-first software. Security work focuses on keeping secrets encrypted at rest, limiting what leaves the device, and being clear about what the current builds do not yet protect.

Secrets at rest

  • Provider API keys and the Coding-mode GitHub PAT are stored asAES-256-GCM ciphertext in settings, with key material derived usingArgon2id and files under .nova_crypto/.
  • Keys are decrypted on-device only long enough to call your configured provider.
  • Persistent Sage does not send API keys to a Persistent Sage-operated server.

Network posture

  • Provider and update traffic use HTTPS where supported.
  • Agent web tools are opt-in and include SSRF guards on fetches.
  • Browser fetch uses a local Chromium/Edge binary when you enable it.
  • Git HTTPS uses an askpass helper so PATs are not written into .git/config.

LAN pairing (mobile ↔ desktop)

Planned and partially implemented device sync uses a short-lived 6-digit PIN over your local Wi-Fi network—no cloud required for LAN sync. Treat PIN pairing like handing someone physical access on your LAN: use it only on networks you trust.

What is not protected today

Chat database encryption is not implemented.nova_memory.sqlite, personality JSON, and attachment files are readable to anyone who can access your user account or a backup of the data folder.

Direct-download Windows NSIS builds may lack Authenticode signing (SmartScreen warnings). Store MSIX builds are Microsoft-signed through Partner Center.

There is no multi-user ACL model, enterprise audit log, or Persistent Sage-operated E2EE cloud storage in current desktop releases.

Cloud Sync (future)

Mobile Premium may add optional end-to-end encrypted Cloud Sync. Design intent: the server stores ciphertext only; passphrase or recovery UX is still an open product decision. Do not assume E2EE cloud sync is available until it is marked shipped.

Reporting vulnerabilities

Please do not open public issues with exploit details. Follow the process inSECURITY.mdin the desktop repository.

Practical hardening tips

  1. Enable full-disk encryption on the host OS.
  2. Prefer local Ollama for sensitive prompts when possible.
  3. Keep agent tools off unless you need them.
  4. Quit the app before copying or restoring the data folder.
  5. Back up deliberately; treat backups with the same care as the live data directory.