Security & Privacy Policy
Relevant source files
The following files were used as context for generating this wiki page:
The Security & Privacy Policy of ThinkEx outlines the protocols for vulnerability management, data protection, and community standards. As an open-source platform designed for compounding knowledge, ThinkEx prioritizes transparency in its security fix policy and provides users with control over their data through flexible hosting and storage options.
This policy covers the technical implementation of security measures, ranging from database Row Level Security (RLS) to the handling of AI context to ensure user privacy and system integrity.
Vulnerability Disclosure and Management
ThinkEx maintains a proactive stance on security vulnerabilities. The project encourages responsible disclosure and follows a structured timeline for public notification of issues.
Reporting Process
Security issues must not be reported via public GitHub issues. Instead, they should be disclosed privately via email to hello@thinkex.app.
Sources: SECURITY.md:3-7
Disclosure Timeline
The project adheres to a 90-day grace period for security fixes:
- Fix Phase: Maintainers handle the fix through standard Pull Requests and releases.
- Identification: Release notes include GitHub Advisory Database (GHSA) numbers and CVE identifiers where applicable.
- Public Disclosure: The vulnerability is published only after the 90-day period has elapsed to allow users to update their installations.
Sources: SECURITY.md:11-22
Data Privacy and Storage Architecture
ThinkEx provides multiple layers of data control, allowing users to choose between local self-hosting or managed cloud services. This architecture is designed to prevent "black box" retrieval mechanisms and ensure users see exactly what the AI sees.
Storage Options
Users can configure their storage backend via the STORAGE_TYPE environment variable.
| Storage Type | Description | Privacy Impact |
|---|---|---|
local | Files stored in the ./uploads directory. | Full local control; no external data transit for storage. |
supabase | Cloud-based storage using Supabase buckets. | Data stored externally; requires Supabase API credentials. |
Sources: README.md:143-157, setup.sh:66-79
Database Security
The system uses PostgreSQL with Drizzle ORM. During setup, specific roles and schemas are created to support security policies.
The setup.sh script initializes an authenticated role and an auth schema. A mock auth.jwt() function is established to facilitate Row Level Security (RLS) policies within the database, ensuring that users can only access their own data.
Sources: setup.sh:233-255, README.md:65-71
AI Context and Privacy Constraints
ThinkEx employs "User-Controlled Context," where AI reasoning is limited to specifically selected cards or document sections.
Context Isolation
The system prompt strictly instructs the AI to rely only on facts from fetched content and explicitly forbids inventing information.
Sources: src/lib/utils/format-workspace-context.ts:114-115
Prompt Security
The system includes constraints to prevent prompt injection or instructions that attempt to override security guidelines.
Network and Access Control
Crawling Behavior
The robots.txt file is configured to protect private areas of the application while allowing public discovery of share links.
- Allowed:
/,/api/share/* - Disallowed:
/workspace/,/dashboard/,/auth/,/api/,/_next/,/uploads/
Sources: public/robots.txt:4-16
API Security
API endpoints, such as the autogen route, implement strict validation to prevent Server-Side Request Forgery (SSRF). For example, file URLs provided during workspace generation are validated against allowed patterns before processing.
Sources: src/app/api/workspaces/autogen/route.ts:316-324
Community Standards (Code of Conduct)
To maintain a healthy development environment, ThinkEx enforces a Code of Conduct. Instances of harassment or unacceptable behavior can be reported to support@thinkex.app.
Enforcement Ladder
- Correction: Private warning and clarification.
- Warning: Warning with interaction restrictions.
- Temporary Ban: Specified period of communication ban.
- Permanent Ban: Pattern of violation results in a permanent ban.
Sources: CODE_OF_CONDUCT.md:54-94
Summary
The Security & Privacy Policy of ThinkEx centers on a 90-day vulnerability disclosure cycle, user-controlled data storage, and strict AI context boundaries. By providing local hosting options and implementing database-level isolation through RLS, ThinkEx ensures that knowledge remains persistent and organized without compromising user privacy. All community interactions are further governed by a structured enforcement policy to ensure a professional and safe environment for contributors.