I just ran an security analysis on the repo. As is, it's not looking great (again nothing against vibe/agentic coded projects) the lack of security consideration is astonishing (not suggesting a malice). Definitely NOT production ready.

  Context: about 98% of the commits are by AI bots (Antigravity, Google Jules).
  That explains the bugs below.

  Security bugs

  1. High: the local web API lets any website use the user's files.
  - paperpilot-gateway/src/server.rs:95-98 allows requests from any website, and
    there's no login or authentication.
  - POST /api/v1/pdf/mcp-exec (handlers.rs:233) runs any tool with any file path
    on the machine.
  - So while the API is running, any web page the user visits can make it
    overwrite files with PDFs, create folders, and read back text from any local
    PDF.
  - In the desktop app the user has to switch the API on. But docker-compose.yml
    opens it to the network with no authentication.
  - There's also no limit on request size (usize::MAX), so one huge request can
    exhaust memory.

  2. High: a malicious document can run code in the desktop app.
  - Search results display text from the user's own documents as raw HTML
    without escaping it:
    - WorkspaceSearchModal.svelte:297
    - workspaceSearch.ts:84
    - WorkspaceSearchModal.svelte:118
  - The app has no Content Security Policy, and lets its window read any file on
    disk (tauri.conf.json:28-33, scope "**").
  - So a PDF or DOCX carrying an <img onerror=…> payload could read any local
    file and send it out once the user searches it.

  3. Medium: downloaded models and add-on packs are never verified.
  - There's no checksum check on models (ai_commands.rs, ocr_commands.rs). Some
    come straight from the repo's live main branch, so whatever lands there
    ships to users.
  - Pack downloads (pack_commands.rs:147-151) put pack_id straight into the file
    path. A value containing ../ writes outside the app's data folder.
  - Packs come from huggingface.co/paperpilot/packs, an account I didn't confirm
    the project owns.

  4. Medium/Low: the protection against fetching internal addresses can be
  bypassed (paperpilot-core/src/url_fetch.rs:24-40).
  - It only checks IP addresses typed directly into the URL, not what a domain
    name resolves to.
  - It follows redirects, so a public URL can redirect to an internal one.
  - IPv6 addresses ([::1]), 0.0.0.0 and the 100.64.0.0/10 range get through.
  - The impact is limited because the response must start with %PDF.

  5. Low: CI supply chain.
  - release.yml installs wasm-pack via curl | sh.
  - GitHub Actions are pinned to version tags, not commit hashes.
  - The Android build ignores the lockfile (--no-frozen-lockfile).