Security

The Qalatra desktop application is local-first by design. Used on its own it has no server to send anything to: your tasks, notes and habits live in a SQLite database on your machine at ~/.qalatra/, and the attack surface of the application is therefore your own machine, not a cloud backend.

The built-in MCP server listens on localhost:3457 only and is not exposed to the network. Agent configurations run with the permissions of your user account — just like a terminal command you'd run yourself.

Our paid hosted services do involve our infrastructure, and we would rather say so here than let the paragraph above read as a promise they do not keep. Qalatra Connect is a hosted web app: we serve it and run account sign-in and seat checks, and it then talks over HTTPS (TLS) to the Qalatra Server you connect it to, using a token you create. Your tasks live on that server, whether it is your own machine or a Cloud node. Connect is not end-to-end encrypted.

Cloud agent nodes are machines we provision and manage for you, so data on them sits on infrastructure we operate. Their application traffic goes through a managed Cloudflare tunnel rather than a public application port, and each node carries scoped telemetry credentials. Accounts, seats and billing records for both products are described in our privacy policy.

Using the desktop app alone requires none of this, and does not require an account.

If you discover a security vulnerability in Qalatra, please report it privately before disclosing publicly. We take all reports seriously and will respond promptly.

Email: [email protected]

GitHub: Use GitHub's private vulnerability reporting on the qalatra repository.

Please include a description of the issue, steps to reproduce, and your assessment of impact. We'll acknowledge receipt within 48 hours and aim to issue a fix within 14 days for confirmed vulnerabilities.

We're interested in vulnerabilities that allow an attacker to:

• Read or modify another user's local database without their consent
• Execute arbitrary code via a malformed agent config, task, or daily note
• Escape the MCP server's localhost-only binding
• Exfiltrate data via the auto-update mechanism
• Bypass agent permission restrictions defined in agent.config

• Vulnerabilities requiring physical access to the user's machine
• Issues in third-party dependencies already reported upstream
• Social engineering attacks
• Denial of service against a local process

We provide security fixes for the latest stable release only. We strongly recommend keeping Qalatra up to date. You can check for updates in Settings or watch the changelog.

Thank you to the researchers who have reported vulnerabilities responsibly.

• Ganesh RK — October 2026 — old email-verification link still accepted after an email change