docs/SECURITY_CLAIMS.md

Security Claims

Allowed claim:

• Runs locally.
• Does not require Internet for normal use.
• Does not require admin rights in Windows portable mode.
• Does not intentionally upload user data.
• Network is bound to 127.0.0.1 by default.

Do not claim:

• Leaves no trace on the host.
• Forensics-proof.
• Impossible to inspect or copy.
• Secure against a malicious host.
• Secure against keyloggers or screen capture.

Windows records USB insertion and execution metadata. A hostile host can inspect memory, capture keystrokes, or copy files.