Security & Responsible Disclosure

1. Our approach

Security and privacy are designed in from the start. The desktop application processes datasets locally on your machine, disables usage-stat gathering, and makes external AI calls only when you supply your own key. See the Privacy Policy and Data Usage Policy for detail.

2. Practices

• Data minimisation — the app collects nothing; we avoid collecting what we do not need on this website.
• Secrets such as API keys are entered at runtime and never committed to source code.
• Encrypted transport (HTTPS) for this website and the download; connections the app makes (your database, your AI provider) use those services' secure protocols.
• The app's code ships compiled to machine code, and dependencies are kept reasonably current with a lean core to reduce surface area.

3. Responsible disclosure

If you believe you have found a security vulnerability, we appreciate a private, responsible report. Please:

• Give us a reasonable time to investigate and fix before any public disclosure.
• Avoid privacy violations, data destruction, or service disruption while testing.
• Only test against your own installation and data — never another person's.
• Include clear steps to reproduce so we can act quickly.

Acting in good faith under these guidelines, we will not pursue action against you for your research, and we will credit you if you wish once the issue is resolved.

4. What is in scope

The ATARS application and this website. Out of scope: third-party services we link to, your own chosen AI provider, and issues that require physical access to your device.

5. How to report

Send details through the contact page and mark it as a security report. We aim to acknowledge valid reports promptly.

6. No warranty

We work hard on security, but no system is perfectly secure. Please handle sensitive data with appropriate care, as described in our Terms and Disclaimer.