Security & privacy

The fear is rational

In the last eighteen months: malicious AI-assistant extensions exfiltrated files from 1.5M installs, an npm supply-chain attack weaponized local AI CLIs against their own machines, and a popular LLM gateway was compromised on PyPI. Anything that sits in your model traffic is a target, and “just trust us” is not an answer.

Legroom’s answer is architectural: minimize what exists, keep it local, open the code that touches it.

Local-first, by topology

Legroom runs on your machine, between your harness and the API. Your prompts, code, and diffs travel exactly where they traveled before — to your model provider — and nowhere else. There is no Legroom cloud in the data path, no relay, no “anonymized” mirror.

If Legroom crashes, traffic passes through. The meter must never block or lose your work; parsing, pricing, and ledger errors are always non-fatal.

Raw capture is opt-in, local, and loud

By default Legroom is content-free. A separate, explicit opt-in (wire capture) can record raw traffic locally for debugging — it is off by default, local-only, and clearly marked when active. It never feeds any remote system.

No telemetry — and the one network call we will document

The binary contains no telemetry. No usage pings, no crash reporters, no “anonymous statistics”. Insight comes from edge analytics on this website and from what users choose to share.

Planned exception, stated in advance: an update check (version + platform, no unique identifier), opt-out, documented field by field before it ships. If we ever revisit in-binary signals post-launch, it will be opt-in at install with a published schema — pull, never push.

Open exactly where trust is decided

The entire data path — proxy, protocol translation, ledger, capture policy, detectors, routing, pack engine — is Apache-2.0. Paid intelligence ships as signed data packs executed by that open engine; packs reference derived features (token counts, tool names, cache state), never raw content. No closed code in the data path, ever.

Supply-chain posture: pinned lockfiles, cargo-audit and dependency scanning in CI from day one; signed and notarized releases by launch; SBOM and OpenSSF Scorecard on the roadmap. Build from source or verify our signature — both are first-class paths.

The machine boundary is the consent boundary

Everything above runs on one machine. The commercial features — sync, team dashboards, policy distribution — are exactly the features that cross the machine boundary, and each one states what raw or derived data is included, excluded, redacted, or encrypted before you turn it on. Paying is the consent surface; nothing crosses silently.