The public repository is not open yet. The GitHub features and the repository files mentioned below become available when it opens; until then, the Cloud waitlist on the home page is the way to hear about it.

Security policy

RagMyLife indexes a person's private messages, e-mail and documents. Treat every report as sensitive.

Reporting a vulnerability

Use GitHub's private vulnerability reporting ("Security" tab → "Report a vulnerability") on this repository. Do not open a public issue or discussion for a security problem. Include the version (commit) you tested, the component (gateway, a connector, a front, the installer) and a reproduction. You should hear back within 7 days.

Scope

In scope: the MCP gateway (OAuth, ACL, manual_code), the web fronts and their sessions, the connectors (e-mail, WhatsApp import, libraries), the installer and default configuration, and any path by which indexed content could leave the machine without the owner's opt-in.

Out of scope: vulnerabilities in third-party services you connect (Google, Qdrant Cloud, model providers), and the WhatsApp live-capture plugin, which has its own repository and policy.

Supported versions

The main branch and the latest tagged release.

Hardening notes for operators

Keep the gateway behind an authenticated tunnel (Tailscale Serve/Funnel, Cloudflare Tunnel or a reverse proxy with TLS); bind backend ports to 127.0.0.1 only; keep etc/ and var/ out of any shared location; review the owner e-mail and ACL files after installing.