LockSpec runs locally over stdio. Indexed specs are stored only on the user's own machine (~/.lockspec/) and are never sent to LockSpec or any third party.

If you discover a security issue in LockSpec, please report it privately rather than opening a public issue.

Email: security@lockspec.io

We will acknowledge your report and work with you on a coordinated disclosure timeline.