Aniloop is under active development. Security fixes target the main branch and the latest Anivault release. Older tags are not patched.

Aniloop skills produce self-contained, offline HTML study pages:

• No external libraries, CDNs, or network requests; everything is inline.
• Progress is stored only in the browser's localStorage, namespaced per deck.
• No user data leaves the page; there is no server, account, or telemetry.

Given that, the realistic security surface is small and mostly about the generated HTML/JS (e.g. unescaped user content rendered into a card, or a change to the interaction core that could mishandle stored state), and about the install path (the install.sh script and the skill files an agent loads).

Please do not open a public issue for security problems.

Report privately via GitHub: open a private security advisory on this repository, or contact the maintainer (@loraldx) through GitHub's private reporting channel. Include:

• affected component (Anirox / Anivault / engine / install script) and version;
• a description and, ideally, a minimal reproduction;
• the impact you foresee.

We aim to acknowledge reports within a few days and to fix confirmed issues on a best-effort basis, crediting reporters who wish to be credited.

• Content-accuracy issues in generated cards (these are quality bugs — use a normal issue).
• Behavior of third-party agent runtimes that load the skills.